[{"data":1,"prerenderedAt":1850},["ShallowReactive",2],{"sc:header-data-ja":3,"sc:footer-data-ja":489,"post-ja--posts-2025-01-14-compliant-device-bypass-184506556cb284":519,"authors_data":1262,"content-ja-list-7b291c2dd91a4":1614,"authors_data:Christopher Brumm|Fabian Bader|Thomas Naunheim":1845},{"lang":4,"home":5,"navigation":17,"meta":479,"contact":485},"de",{"name":6,"folderSwitch":7,"imgLight":10,"img":11,"languages":12},"home",[8,9],"authors","blog","/logos/gk-Logo-sw.svg","/logos/gk-Logo-rgb.svg",{"ja":13},{"title":14,"url":15,"alt":16},"ホーム","/ja","glueckkanja Logo",[18,127,231,316,395,402],{"name":19,"languages":20,"children":24},"workplace",{"ja":21},{"title":22,"description":23},"Workplace","Microsoft 365を基盤に、スマートで安全な、柔軟性の高いワークプレイスを実現します。最新のテクノロジーとアイデンティティサービスが一つにつながります。",[25,55,91],{"name":26,"languages":27,"children":30},"portfolio",{"ja":28},{"title":29},"Portfolio",[31,37,43,49],{"name":32,"languages":33},"managed-intune",{"ja":34},{"title":35,"url":36},"Managed Intune","/ja/entra-intune/managed-intune",{"name":38,"languages":39},"managed-entra",{"ja":40},{"title":41,"url":42},"Managed Entra","/ja/entra-intune/managed-entra",{"name":44,"languages":45},"managed-workplace",{"ja":46},{"title":47,"url":48},"Managed Workplace","/ja/workplace/managed-workplace",{"name":50,"languages":51},"consulting-services",{"ja":52},{"title":53,"url":54},"Consulting Services","/ja/workplace/consulting-services",{"name":56,"languages":57,"children":60},"microsoft-365-endpoint",{"ja":58},{"title":59},"Microsoft 365 Endpoint",[61,67,73,79,85],{"name":62,"languages":63},"microsoft-entra-suite",{"ja":64},{"title":65,"url":66},"Microsoft Entra Suite","/ja/workplace/microsoft-entra-suite",{"name":68,"languages":69},"microsoft-intune",{"ja":70},{"title":71,"url":72},"Microsoft Intune","/ja/workplace/microsoft-intune",{"name":74,"languages":75},"microsoft-windows",{"ja":76},{"title":77,"url":78},"Microsoft Windows","/ja/workplace/microsoft-windows",{"name":80,"languages":81},"windows-365-cloud-pc",{"ja":82},{"title":83,"url":84},"Windows 365 Cloud PC","/ja/workplace/windows365-cloud-pc",{"name":86,"languages":87},"cloud-workplace-foundation",{"ja":88},{"title":89,"url":90},"Cloud Workplace Foundation","/ja/workplace/cloud-workplace-foundation",{"name":92,"languages":93,"children":96},"microsoft-365-collaboration",{"ja":94},{"title":95},"Microsoft 365 Collaboration",[97,103,109,115,121],{"name":98,"languages":99},"microsoft-copilot",{"ja":100},{"title":101,"url":102},"Microsoft 365 Copilot","/ja/workplace/microsoft-365-copilot",{"name":104,"languages":105},"microsoft-teams",{"ja":106},{"title":107,"url":108},"Teams","/ja/workplace/microsoft-teams",{"name":110,"languages":111},"sharepoint-powerplatform",{"ja":112},{"title":113,"url":114},"SharePoint & Power Platform","/ja/workplace/sharepoint-power-platform",{"name":116,"languages":117},"exchange-online",{"ja":118},{"title":119,"url":120},"Exchange Online","/ja/workplace/exchange-online",{"name":122,"languages":123},"information-protection-compliance",{"ja":124},{"title":125,"url":126},"Information Protection & Compliance","/ja/workplace/information-protection-compliance",{"name":128,"languages":129,"children":133},"azure",{"ja":130},{"title":131,"description":132},"Azure","Azureで成長を後押しします。IaaSとPaaSによって、クラウドのコストを下げ、効率を高め、イノベーションを進めます。",[134,151,181],{"name":135,"languages":136,"children":138},"azure-portfolio",{"ja":137},{"title":29},[139,145],{"name":140,"languages":141},"azure-managed-services",{"ja":142},{"title":143,"url":144},"Azure Managed Services","/ja/azure/azure-managed-services",{"name":146,"languages":147},"azure-consulting",{"ja":148},{"title":149,"url":150},"Azure Consulting","/ja/azure/azure-consulting",{"name":152,"languages":153,"children":156},"azure-scenarios",{"ja":154},{"title":155},"シナリオ",[157,163,169,175],{"name":158,"languages":159},"plan-your-cloud",{"ja":160},{"title":161,"url":162},"クラウドを計画する","/ja/azure/plan-your-cloud",{"name":164,"languages":165},"migrate-to-the-cloud",{"ja":166},{"title":167,"url":168},"クラウドへ移行する","/ja/azure/migrate-to-the-cloud",{"name":170,"languages":171},"innovate-your-business",{"ja":172},{"title":173,"url":174},"ビジネスを刷新する","/ja/azure/innovate-your-business",{"name":176,"languages":177},"vmware-exit",{"ja":178},{"title":179,"url":180},"VMware戦略を立て直す","/ja/azure/vmware-exit",{"name":182,"languages":183,"children":186},"azure-practices",{"ja":184},{"title":185},"Practices",[187,193,199,202,208,213,219,225],{"name":188,"languages":189},"azure-foundation",{"ja":190},{"title":191,"url":192},"Azure Foundation","/ja/azure/azure-foundation",{"name":194,"languages":195},"azure-ai-foundation",{"ja":196},{"title":197,"url":198},"Azure AI Foundation","/ja/azure/azure-ai-foundation",{"name":86,"languages":200},{"ja":201},{"title":89,"url":90},{"name":203,"languages":204},"azure-data-foundation",{"ja":205},{"title":206,"url":207},"Azure Data Foundation","/ja/azure/azure-data-foundation",{"name":188,"languages":209},{"ja":210},{"title":211,"url":212},"Azure Container Foundation","/ja/azure/azure-container-foundation",{"name":214,"languages":215},"dark-tenant",{"ja":216},{"title":217,"url":218},"Managed Dark Tenant","/ja/azure/managed-dark-tenant",{"name":220,"languages":221},"azure-cloud-adoption-framework",{"ja":222},{"title":223,"url":224},"Cloud Adoption Framework","/ja/azure/cloud-adoption-framework",{"name":226,"languages":227},"azure-cloud-competence-center",{"ja":228},{"title":229,"url":230},"Cloud Competence Center","/ja/azure/cloud-competence-center",{"name":232,"languages":233,"children":242},"security",{"ja":234},{"title":235,"description":236,"emergency":237},"Security","受賞歴のある24時間365日のManaged Service、インシデント対応、最新水準の保護で、クラウドの安全を見守り、インフラを守ります。",{"text":238,"href":239,"skin":240,"icon":241},"サイバー攻撃の渦中ですか？","/ja/security/are-you-under-attack","primary","emergency",[243,268,289],{"name":244,"children":245},"security-security-consulting",[246,252,256,262],{"name":247,"languages":248},"managed-red-tenant",{"ja":249},{"title":250,"url":251},"Managed Red Tenant","/ja/security/managed-red-tenant",{"name":214,"languages":253},{"ja":254},{"title":255,"url":218},"Dark Tenant",{"name":257,"languages":258},"sentinel-data-lake",{"ja":259},{"title":260,"url":261},"Sentinel Data Lake","/ja/security/sentinel-data-lake",{"name":263,"languages":264},"security-consulting",{"ja":265},{"title":266,"url":267},"Security Consulting","/ja/security/security-consulting",{"name":269,"children":270},"security-cloud-security-operations-center",[271,277,283],{"name":272,"languages":273},"cloud-security-operations-center",{"ja":274},{"title":275,"url":276},"Cloud Security Operations Center","/ja/security/cloud-security-operations-center",{"name":278,"languages":279},"global-secure-access",{"ja":280},{"title":281,"url":282},"Global Secure Access","/ja/security/global-secure-access",{"name":284,"languages":285},"my-work-id",{"ja":286},{"title":287,"url":288},"MyWorkID","/ja/security/my-work-id",{"name":290,"children":291},"security-preventive-services",[292,298,304,310],{"name":293,"languages":294},"preventive-services",{"ja":295},{"title":296,"url":297},"Preventive Services","/ja/security/preventive-services",{"name":299,"languages":300},"data-security-services",{"ja":301},{"title":302,"url":303},"Data Security Service","/ja/security/data-security-service",{"name":305,"languages":306},"security-copilot-agents",{"ja":307},{"title":308,"url":309},"Security Copilot Agents","/ja/security/security-copilot-agents",{"name":311,"languages":312},"nis2",{"ja":313},{"title":314,"url":315},"NIS2を技術で実装する","/ja/security/red-dark-tenant-nis2",{"name":317,"languages":318,"children":322},"products",{"ja":319},{"title":320,"description":321},"製品","完全に安全で100%クラウドネイティブなMicrosoft環境のためのCompanion製品です。協働、ネットワーク認証、ソフトウェア管理を強化します。",[323,360],{"name":324,"products":325,"children":326},"lorem ipsum 1",true,[327,336,344,352],{"name":328,"img":329,"target":330,"languages":331},"realmjoin","products/realmjoin/realmjoin-nav-logo.svg","_blank",{"ja":332},{"title":333,"url":334,"subtitle":335},"RealmJoin","https://www.realmjoin.com","クラウドベースのソフトウェア配布",{"name":337,"img":338,"target":330,"languages":339},"scepman","products/scepman/scepman-nav-logo.svg",{"ja":340},{"title":341,"url":342,"subtitle":343},"SCEPman","https://www.scepman.com","クラウドからの証明書配布",{"name":345,"img":346,"target":330,"languages":347},"konnekt","products/konnekt/konnekt-nav-logo.svg",{"ja":348},{"title":349,"url":350,"subtitle":351},"KONNEKT","https://www.konnekt.io","Office 365のデータをローカルで利用",{"name":353,"img":354,"target":330,"languages":355},"realmigrator","products/realmigrator/realmigrator-nav-logo.svg",{"ja":356},{"title":357,"url":358,"subtitle":359},"RealMigrator","https://www.realmigrator.com","サーバー間のデータ移行",{"name":361,"products":325,"children":362},"lorem ipsum 2",[363,371,379,387],{"name":364,"img":365,"target":330,"languages":366},"terraprovider","products/terraprovider/terraprovider-nav-logo.svg",{"ja":367},{"title":368,"url":369,"subtitle":370},"TerraProvider","https://www.terraprovider.com","Microsoft 365向けのTerraform Provider",{"name":372,"img":373,"target":330,"languages":374},"radiusaas","products/radius/radius-nav-logo.svg",{"ja":375},{"title":376,"url":377,"subtitle":378},"RADIUSaaS","https://www.radius-as-a-service.com","ネットワークの認証",{"name":380,"img":381,"target":330,"languages":382},"unifiedcontacts","products/unified-contacts/unifiedcontact-nav-logo.svg",{"ja":383},{"title":384,"url":385,"subtitle":386},"Unified Contacts","https://www.unified-contacts.com","Microsoft Teamsで連絡先を探す",{"name":388,"img":389,"target":330,"languages":390},"autopilotmonitor","products/autopilot-monitor/AutopilotMonitor-nav-logo.svg",{"ja":391},{"title":392,"url":393,"subtitle":394},"Autopilot Monitor","https://www.autopilotmonitor.com","Windows Autopilotのリアルタイム監視",{"name":396,"languages":397},"casestudies",{"ja":398},{"title":399,"url":400,"description":401},"導入事例","/ja/casestudies","当社はクラウドの先駆者として、包括的なクラウドソリューションを提供するMicrosoftのトップパートナーです。ブループリントに基づくアプローチとInfrastructure as Codeの知見が土台にあります。",{"name":403,"languages":404,"children":407},"company",{"ja":405},{"title":406,"description":401},"会社",[408,438,462],{"name":409,"languages":410,"children":413},"company-about-us",{"ja":411},{"title":412},"会社概要",[414,420,426,432],{"name":415,"languages":416},"company-facts-figures",{"ja":417},{"title":418,"url":419},"Facts & Figures","/ja/company/facts-and-figures",{"name":421,"languages":422},"company-contact",{"ja":423},{"title":424,"url":425},"お問い合わせと拠点","/ja/company/contact-and-locations",{"name":427,"languages":428},"switzerland",{"ja":429},{"title":430,"url":431},"スイスのglueckkanja","/ja/company/switzerland",{"name":433,"languages":434},"austria",{"ja":435},{"title":436,"url":437},"オーストリアのglueckkanja","/ja/company/austria",{"name":439,"languages":440,"children":443},"company-career",{"ja":441},{"title":442},"キャリア",[444,450,456],{"name":445,"languages":446},"company-career-overview",{"ja":447},{"title":448,"url":449},"採用情報","/ja/career",{"name":451,"languages":452},"company-young-professionals",{"ja":453},{"title":454,"url":455},"Young Professionals","/ja/young-professionals",{"name":457,"languages":458},"company-jobs",{"ja":459},{"title":460,"url":461},"募集職種","/ja/job-offers",{"name":463,"languages":464,"children":467},"company-latest",{"ja":465},{"title":466},"最新情報",[468,474],{"name":469,"languages":470},"company-blog",{"ja":471},{"title":472,"url":473},"ブログ","/ja/blog",{"name":469,"languages":475},{"ja":476},{"title":477,"url":478},"イベント","/ja/events",[480],{"name":481,"languages":482},"career-meta",{"ja":483},{"title":442,"url":449,"active":484},false,{"languages":486},{"ja":487},{"title":488,"url":425,"active":484},"お問い合わせ",{"data":490},{"bgColor":491,"number":492,"mail":493,"brandLogos":494,"logos":495,"links":499,"linksJa":509},"var(--color-gk-mid-blue)","+49 69 4005520","info@glueckkanja.com",null,[496],{"img":10,"alt":16,"url":497,"class":498},"index.html","max-w-19rem",[500,503,506],{"title":501,"url":502},"Datenschutz","/de/privacy",{"title":504,"url":505},"Impressum","/de/imprint",{"title":507,"url":508},"No Cookies","/de/cookies",[510,513,516],{"title":511,"url":512},"プライバシーポリシー","/ja/privacy",{"title":514,"url":515},"運営者情報","/ja/imprint",{"title":517,"url":518},"Cookieなし","/ja/cookies",{"id":520,"title":521,"author":522,"body":526,"cta":494,"description":1165,"eventid":494,"extension":1184,"hideInRecent":484,"layout":1185,"meta":1186,"moment":1190,"navigation":325,"path":1254,"seo":1255,"stem":1256,"tags":1257,"webcast":484,"__hash__":1261},"content_ja/posts/2025-01-14-compliant-device-bypass.md","Compliant Device Bypass - 知っておくべきことのすべて",[523,524,525],"Fabian Bader","Christopher Brumm","Thomas Naunheim",{"type":527,"value":528,"toc":1164},"minimal",[529,533,537,591,595,597,610,618,629,635,638,641,643,648,651,654,658,724,727,730,733,735,739,741,756,763,766,769,771,774,777,780,788,799,802,804,807,811,813,816,821,824,826,829,832,835,998,1001,1003,1006,1046,1049,1051,1058,1061,1064,1079,1082,1085,1139,1147,1150,1152,1155,1158,1161],[530,531,532],"h2",{"id":532},"これまでの経緯",[534,535,536],"p",{},"{: .h3-font-size}",[538,539,540,564,579,588],"ul",{},[541,542,543,544,551,552,557,558,563],"li",{},"2024年12月、",[545,546,550],"a",{"href":547,"rel":548},"https://x.com/TEMP43487580",[549],"nofollow","Yuya Chudo","氏がBlack Hat Europeカンファレンスで「",[545,553,556],{"href":554,"rel":555},"https://www.blackhat.com/eu-24/briefings/schedule/#unveiling-the-power-of-intune-leveraging-intune-for-breaking-into-your-cloud-and-on-premise-42176",[549],"Unveiling the Power of Intune: Leveraging Intune for Breaking Into Your Cloud and On-Premise","」と題した講演を行いました。このセッションでは、デバイスコンプライアンスに関する条件付きアクセス（CA）のハードコードされたほとんど知られていない除外設定を、Entra IDの文書化されていない「",[545,559,562],{"href":560,"rel":561},"https://github.com/secureworks/family-of-client-ids-research",[549],"FOCI機能","」と組み合わせて悪用する方法が示されました。講演では、この挙動は仕様どおりであり新しいデバイスのIntune Enrollmentを成功させるために必要である、というMicrosoft MSRC（VULN-123240）の回答も紹介されています。",[541,565,566,567,572,573,578],{},"カンファレンスの数日後、Sunny Chau氏が概念実証ツール",[545,568,571],{"href":569,"rel":570},"https://github.com/JumpsecLabs/TokenSmith",[549],"TokenSmith","を",[545,574,577],{"href":575,"rel":576},"https://labs.jumpsec.com/tokensmith-bypassing-intune-compliant-device-conditional-access/",[549],"関連するブログ記事","とともに公開しました。これによってこの手法はより広い層に知られることになりました。",[541,580,581,582,587],{},"さらに、",[545,583,586],{"href":584,"rel":585},"https://github.com/zh54321/PoCEntraDeviceComplianceBypass/blob/main/poc_entra_compliance_bypass.ps1",[549],"PowerShellで書かれたPoC","も公開されています。",[541,589,590],{},"12月末以降、私たちglueckkanja AGはこの手法をどのように防止し検知できるかを調査してきました。本記事では、この攻撃に関する知見の一部を共有し、緩和策と検知の選択肢について述べます。",[530,592,594],{"id":593},"tldr","TL;DR",[534,596,536],{},[534,598,599,600,605,606],{},"条件付きアクセスには、特定の課題を解決するために、一部のGrant Controls/Conditionsに対する除外があらかじめ組み込まれているリソースが存在します。そのひとつが、デバイスコンプライアンスに対するCompany Portal Appの除外です。これは、デバイスがコンプライアンス準拠と判定される前にIntuneへ登録しなければならないという、鶏と卵の問題を解決するためのものです。この挙動は",[545,601,604],{"href":602,"rel":603},"https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-alt-all-users-compliant-hybrid-or-mfa#:~:text=You%20can%20enroll,Company%20Portal%20application",[549],"こちらに文書化されています","。\n",[607,608,609],"strong",{},"つまり、CAポリシーが「All resources」に対してDevice Complianceを強制していても、管理されていないデバイスからこのアプリのアクセストークンとリフレッシュトークンを取得できるということです。",[534,611,612,617],{},[613,614],"img",{"alt":615,"src":616},"image.png","https://res.cloudinary.com/c4a8/image/upload/blog/pics/company-portal-ca-bypass-02.png","{: .post__screenshot}",[534,619,620,621,625,626],{},"MicrosoftはFamily of Client IDs（FOCI）という機能を実装しています。これは、あるグループに属するMicrosoftのOAuthクライアントアプリケーションが、自らのリフレッシュトークンを使ってそのファミリー内の別のクライアントとしてアクセストークンを取得できるようにするものです。本来OAuth2標準では認められていない挙動です。詳細は",[545,622,624],{"href":560,"rel":623},[549],"Secureworksの元の調査","をご覧ください。\n",[607,627,628],{},"Company Portal Appは「ファミリーメンバー」であるため、そのために要求したリフレッシュトークンを使って、同じファミリー内の他のアプリ向けのトークンを取得できます。",[534,630,631,632],{},"FOCI機能には制限があり、クライアントIDとリソースの間のコンセントは明示的に構成され付与されている必要があります。Company Portal Appの場合、このコンセントは、制限されたスコープでのMicrosoft Graphへのアクセスや、現在のユーザーの権限でのAzure AD Graph APIへのアクセスなどに対して付与されています。\n",[607,633,634],{},"つまり、Company Portalのリフレッシュトークンを使って、たとえばスコープuser_impersonationでAzure AD Graph APIのアクセストークンを取得でき、AADInternalsやROADreconなどで多くの操作が可能になります。",[534,636,637],{},"この攻撃を実行するには、攻撃者は被害者の有効な資格情報に加え、条件付きアクセスが要求する場合はMFAを実行できることが必要です。あるいは、有効なリフレッシュトークンが必要です。",[530,639,640],{"id":640},"どのようなリスクと影響範囲があるのか",[534,642,536],{},[644,645,647],"h3",{"id":646},"コンプライアンスの除外の影響を受けるリソーススコープはどれか","コンプライアンスの除外の影響を受けるリソース（スコープ）はどれか",[534,649,650],{},"{: .h4-font-size}",[534,652,653],{},"攻撃者は、前述のとおり別のFOCIアプリケーション向けのトークンを要求できます。ただしMicrosoftは、特定のリソースアプリケーションの一部のAPIアクセス許可スコープへのトークン取得についてのみ、デバイスコンプライアンス要件のバイパスを実装しています。とりわけ次の委任されたAPIアクセス許可は機微であり、攻撃者にとって関心の対象となります。",[655,656,657],"style",{},"\ntable {\n  font-family: arial, sans-serif;\n  border-collapse: collapse;\n  width: 100%;\n}\n\ntd, th {\n  border: 1px solid #dddddd;\n  text-align: left;\n  padding: 8px;\n}\n\ntr:nth-child(even) {\n  background-color: #dddddd;\n}\n",[659,660,661,677],"table",{},[662,663,664],"thead",{},[665,666,667,671,674],"tr",{},[668,669,670],"th",{},"Resource Application",[668,672,673],{},"Application Id",[668,675,676],{},"Delegated Permission Scope",[678,679,680,692,703,714],"tbody",{},[665,681,682,686,689],{},[683,684,685],"td",{},"AADGraph",[683,687,688],{},"00000002-0000-0000-c000-000000000000",[683,690,691],{},"user_impersonation",[665,693,694,697,700],{},[683,695,696],{},"Microsoft Graph API",[683,698,699],{},"00000003-0000-0000-c000-000000000000",[683,701,702],{},"“email\", \"openid\", \"profile\",\"Device.Read.All\", \"DeviceManagementConfiguration.Read.All\", \"DeviceManagementConfiguration.ReadWrite.All\", \"ServicePrincipalEndpoint.Read.All\", \"User.Read”",[665,704,705,708,711],{},[683,706,707],{},"Device Registration Service",[683,709,710],{},"01cb2876-7ebd-4aa4-9cc9-d28bd4d359a9",[683,712,713],{},"adrs_access",[665,715,716,719,722],{},[683,717,718],{},"Windows Azure Service Management API",[683,720,721],{},"797f4846-ba00-4fd7-ba43-dac1f8f63013",[683,723,691],{},[534,725,726],{},"付与されたアクセス許可はアプリケーション自身に対するものではないため、影響の大きさは呼び出し元（ユーザーアカウント）の権限と、どの委任されたアクセス許可スコープがそのスコープでのAPI呼び出しを認可されているかによって変わります。",[534,728,729],{},"ここで示した委任されたアクセス許可スコープの重大性と、機微なAPIを呼び出せる可能性について、もう少し詳しく見ていきましょう。",[530,731,732],{"id":732},"どの権限と委任スコープが危険か",[534,734,536],{},[644,736,738],{"id":737},"azure-ad-graph-api","Azure AD Graph API",[534,740,650],{},[534,742,743,744,749,750,755],{},"このレガシーなプログラミングインターフェイスは、Entra ID（Azure AD）のディレクトリ設定とオブジェクトを管理するための多数のAPIを提供します。条件付きアクセスポリシー、ディレクトリロール、グループやデバイスに対するCRUD、そしてパスワード変更などサインイン中のユーザーに対する操作が含まれます。サポートされる操作の全一覧は",[545,745,748],{"href":746,"rel":747},"https://learn.microsoft.com/en-us/previous-versions/azure/ad/graph/api/api-catalog",[549],"Azure AD Graph APIリファレンス","にあります。このAPIは",[545,751,754],{"href":752,"rel":753},"https://learn.microsoft.com/en-us/graph/migrate-azure-ad-graph-overview",[549],"Microsoftの最新のアナウンス","にもとづき、2025年6月30日に完全に廃止されます。",[534,757,758,759,762],{},"割り当てられた委任スコープ「user_impersonation」は、アプリケーション（この場合はCompany Portal）がユーザーに代わって動作することを可能にします。したがって、サインイン中のユーザーがEntraのオブジェクト、スコープ、ディレクトリレベルに対して持つあらゆるアクセス許可が、API呼び出しの認可として利用され得ます。そのユーザーはEntra IDオブジェクト（アプリケーション、グループ、その他のオブジェクト）の所有者であるかもしれませんし、Entra IDのロール割り当てを通じてアクセス許可を得ているかもしれません。 ",[607,760,761],{},"高い権限を持つロールがアクティブに割り当てられている場合、攻撃者はオブジェクトを変更したり、テナントを侵害したりできてしまいます。"," 少なくとも、何の権限がなくても、既定のユーザー権限だけでテナント内のディレクトリオブジェクトを広範に偵察・列挙することが可能です。",[534,764,765],{},"そのため、Azure AD Graph APIを悪用するシナリオと影響は、対象となるユーザーにアクティブまたは恒久的に割り当てられた権限に左右されます。Microsoft 365のサービスにアクセスするAPI（たとえばOneDriveからの情報持ち出しに使われるもの）はAzure AD Graphには含まれていません。",[644,767,696],{"id":768},"microsoft-graph-api",[534,770,650],{},[534,772,773],{},"Azure AD Graphと比べると、Microsoft Graph APIへの委任スコープは限定されています。OpenIDのスコープ（openid、email、profile）と、ユーザーに代わって行う基本的な読み取り操作（ServicePrincipalEndpoint.Read.All、User.Read）が含まれます。",[534,775,776],{},"「Device.Read.All」を使えば、既定のアクセス許可のままMicrosoft Graphの「device」エンドポイントを呼び出して、すべてのデバイスオブジェクトを一覧表示し読み取ることができます。これは攻撃者がデバイスオブジェクトの情報を得るのに役立ってしまいます。",[534,778,779],{},"「Intune Administrator」が割り当てられているユーザー、またはMicrosoft IntuneのRBACで何らかの委任を受けているユーザーが侵害された場合、次の委任APIアクセス許可は問題があると考えるべきです。",[538,781,782,785],{},[541,783,784],{},"”DeviceManagementConfiguration.Read.All”",[541,786,787],{},"“DeviceManagementConfiguration.ReadWrite.All”",[534,789,790],{},[607,791,792,793,798],{},"これらの委任されたアクセス許可により、たとえばDevice ComplianceやConfigurationのポリシーに対するCRUD操作に加え、対象デバイス上でさらなる悪意ある活動を行うための",[545,794,797],{"href":795,"rel":796},"https://learn.microsoft.com/en-us/graph/api/intune-shared-devicemanagementscript-create?view=graph-rest-beta",[549],"Management Scripts","の展開も可能になります。",[644,800,707],{"id":801},"device-registration-service",[534,803,650],{},[534,805,806],{},"このアクセス許可があれば、攻撃者はデバイスをEntra IDにjoinまたは登録できます。その結果、そのデバイスをIntuneに登録することさえ可能になり、Intuneの構成によっては有効でコンプライアンス準拠のデバイスを手に入れ、さらに多くの保護されたサービスにアクセスできてしまいます。",[644,808,810],{"id":809},"その他のfociアプリケーション","その他のFOCIアプリケーション",[534,812,650],{},[534,814,815],{},"たとえばAzure Resource Manager APIのような他の特権インターフェイスへのアクセス要求もFOCIの対象であり、攻撃者の関心事です。ただしこのリソースは依然として保護されており、条件付きアクセスの許可制御「compliant device」はバイパスされません。",[534,817,818],{},[613,819],{"alt":615,"src":820},"https://res.cloudinary.com/c4a8/image/upload/blog/pics/company-portal-ca-bypass-03.png",[530,822,823],{"id":823},"この攻撃手法を検知できるか",[534,825,536],{},[534,827,828],{},"前述のとおり、最大のリスクはMS GraphとAzure AD Graphへのアクセスから生じます。",[534,830,831],{},"このケースでは常にMicrosoft Intune Company Portal AppのアプリケーションIDが使われるため、検知を作るうえでの主な課題は、デバイス登録などの正当な利用を除外することです。当社の観測では、その切り分けはセッション内で最初にどのリソースへアクセスするかによって決まります。攻撃の場合は、たいていMS GraphかAzure AD Graphです。",[534,833,834],{},"以下は、当社がさまざまな規模の複数の環境で検証した、実際に機能する検知です。",[836,837,839,840,843,844,849,850,854,858,861,862,864,861,868,843,870,872,873,861,877,879,861,882,843,884,886,887,889,861,892,843,894,896,897,900,901,904,905,908,909,843,911,914,915,917,861,920,843,922,900,925,927,928,930,931,933,934,861,937,930,939,942,943,946,947,949,950,914,953,955,861,958,843,960,962,963,843,965,967,968,861,971,973,861,975,843,977,872,979,861,981,983,861,986,843,988,896,990,900,992,904,994,908,996],"div",{"style":838},"background-color:#000000; font-family: 'Source Code Pro', 'Courier New', monospace; padding: 15px; color: #ffffff","\nAADSignInEventsBeta ",[841,842],"br",{},"\n| ",[845,846,848],"span",{"style":847},"color: #569CD6;","where"," Timestamp > ",[845,851,853],{"style":852},"color: #E6DB74;","ago(",[845,855,857],{"style":856},"color: #A6E22E;","7d",[845,859,860],{"style":852},")"," ",[841,863],{},[845,865,867],{"style":866},"color: #75715E;","// Access to Microsoft Intune Company Portal",[841,869],{},[845,871,848],{"style":847}," ApplicationId == ",[845,874,876],{"style":875},"color: #D69D85;","@\"9ba1a5c7-f17a-4de9-a1f1-6178c8d51223\"",[841,878],{},[845,880,881],{"style":866},"// From non joined/registered device",[841,883],{},[845,885,848],{"style":847}," isempty(AadDeviceId) ",[841,888],{},[845,890,891],{"style":866},"// Used to access resource Microsoft Graph or Windows Azure Active Directory",[841,893],{},[845,895,848],{"style":847}," ResourceId ",[845,898,899],{"style":847},"in"," (",[845,902,903],{"style":875},"\"00000002-0000-0000-c000-000000000000\"",", ",[845,906,907],{"style":875},"\"00000003-0000-0000-c000-000000000000\"",") ",[841,910],{},[845,912,913],{"style":847},"summarize by"," SessionId ",[841,916],{},[845,918,919],{"style":866},"// Find the initial logon event based on the session Id",[841,921],{},[845,923,924],{"style":847},"join kind=inner",[841,926],{},"\n    AADSignInEventsBeta ",[841,929],{},"\n    | ",[845,932,848],{"style":847}," ErrorCode == ",[845,935,936],{"style":856},"0",[841,938],{},[845,940,941],{"style":847},"summarize arg_min(","Timestamp, *",[845,944,945],{"style":847},") by"," SessionId)",[841,948],{},"\n    ",[845,951,952],{"style":847},"on",[841,954],{},[845,956,957],{"style":866},"// Ignore trusted and managed devices",[841,959],{},[845,961,848],{"style":847}," isempty(DeviceTrustType) ",[841,964],{},[845,966,848],{"style":847}," IsManaged != ",[845,969,970],{"style":856},"1",[841,972],{},[845,974,867],{"style":866},[841,976],{},[845,978,848],{"style":847},[845,980,876],{"style":875},[841,982],{},[845,984,985],{"style":866},"// when the first requested resource is Microsoft Graph or Windows Azure Active Directory",[841,987],{},[845,989,848],{"style":847},[845,991,899],{"style":847},[845,993,903],{"style":875},[845,995,907],{"style":875},[841,997],{},[530,999,1000],{"id":1000},"不審な活動を検知したらどう対応すべきか",[534,1002,536],{},[534,1004,1005],{},"次の内容を含む定義済みのプレイブックを用いて、インシデント対応プロセスを開始してください。",[538,1007,1008,1029,1037,1040,1043],{},[541,1009,1010,1011],{},"侵害されたユーザーによる不審または異常な活動のハンティング\n",[538,1012,1013,1020,1023,1026],{},[541,1014,1015,1019],{},[1016,1017,1018],"code",{},"sessionId","をもとにした、IPアドレスとUserAgentを含むリソースアプリケーションへの非対話型サインインの要約",[541,1021,1022],{},"Microsoft Entra Audit Logsに、そのユーザーやIPアドレスによる重大な操作（たとえば所有するアプリ登録への資格情報の追加）が記録されていないかの確認",[541,1024,1025],{},"該当セッションでそのユーザーがデバイスを登録していないかの特定",[541,1027,1028],{},"アプリケーション「Company Portal」と対象ユーザーによる操作について、Intuneの監査ログの確認",[541,1030,1031,1032],{},"影響を受けたエンティティに関連するアラートのハンティング\n",[538,1033,1034],{},[541,1035,1036],{},"AlertEvidenceテーブルでエンティティを照会し、SessionId、IPアドレス、ユーザーにもとづく他のアラートを特定",[541,1038,1039],{},"Exposure Managementで、そのユーザーの重大性を権限の観点から特定",[541,1041,1042],{},"ハンティング結果を精査し、その操作がデバイス登録の一環として正当なものだったかを検証",[541,1044,1045],{},"初期侵入経路を特定し、ユーザーの資格情報を、必要に応じてデバイスもリセット",[530,1047,1048],{"id":1048},"攻撃を緩和できるか",[534,1050,536],{},[534,1052,1053,1054,1057],{},"構成されている除外はIntuneの登録に必要なものであるため、 ",[607,1055,1056],{},"Microsoft 365の他の部分を壊さずに済む緩和策はありません。"," Azure AD Graphリソースへのアクセスは、直接スコープを絞ることも遮断することもできません。許可制御に「Block」を用いる条件付きアクセスポリシーはアクセスを防ぎますが、他の影響が生じるおそれがあります。",[534,1059,1060],{},"ただし緩和を考えるうえで重要なのは、この条件付きアクセスのバイパスがそれ単体で完結した攻撃ではないという点です。これは、一連の攻撃を可能にする一段階としての手法です。",[534,1062,1063],{},"想定される攻撃経路は次のようなものです。",[1065,1066,1067,1070,1073,1076],"ol",{},[541,1068,1069],{},"フィッシングとAiTMによるアカウントの侵害",[541,1071,1072],{},"条件付きアクセスのバイパス",[541,1074,1075],{},"ROADrecon、GraphRunner、AADInternalsなどを用いた偵察",[541,1077,1078],{},"Intuneに登録した新しいデバイスを介したラテラルムーブメント、権限昇格、または永続化",[534,1080,1081],{},"Intuneの登録を壊さずに条件付きアクセスのバイパスを緩和することはできないため、攻撃経路の他の段階で緩和策を講じ、あわせて妥当な検知を実装することが十分に理にかなっています。",[534,1083,1084],{},"発生確率と影響を下げるために、他の統制の強度を高め、次の対策を早期に実施することをお勧めします。",[538,1086,1087,1093,1099,1105,1111,1127,1133],{},[541,1088,1089,1092],{},[607,1090,1091],{},"条件付きアクセスで「All Users」と「All Cloud Apps」に対してMFAを強制してください。"," Device Complianceのみを強制している場合、この手法では単要素認証だけで十分になってしまいます。",[541,1094,1095,1098],{},[607,1096,1097],{},"ルールセットでDevice ComplianceとMFAのどちらか一方を使うのではなく、常に両方を強制してください。"," ORを使うと、コンプライアンス準拠のデバイスへのアクセス制限が徹底されません。MFAがスコープに含まれるアクセストークンがあれば、テナントにアクセスできてしまうからです。",[541,1100,1101,1104],{},[607,1102,1103],{},"セキュリティ情報の登録を、コンプライアンス準拠デバイス、フィッシング耐性のある認証、またはTAPに限定してください。"," 当社のテストでは、セキュリティ情報の登録についてDevice Complianceをバイパスすることはできませんでした。",[541,1106,1107,1110],{},[607,1108,1109],{},"デバイスのJoinまたはRegisterにフィッシング耐性のある認証またはTAPを要求してください。"," これがないと、たとえばAADInternalsとこの手法でデバイスを登録できてしまいます。",[541,1112,1113,1116,1117],{},[607,1114,1115],{},"Microsoft Intuneの登録にMFAと「Sign-in frequency every time」を要求してください。"," これにより、攻撃者が新しいデバイスをIntuneに登録するために新鮮な資格情報を使える時間を限定できます。\n",[1118,1119,1120],"blockquote",{},[534,1121,1122,1123,1126],{},"🚧\n",[607,1124,1125],{},"注意: Sign-in frequency every time = 5分ごと","\nMicrosoftは、条件付きアクセスポリシーで「every time」を選択した場合、ユーザーが5分に1回より頻繁に認証を求められないよう、5分のクロックスキューを考慮します。",[541,1128,1129,1132],{},[607,1130,1131],{},"Intuneの登録制限で個人所有デバイスをブロックしてください。"," この制限がないと、攻撃者が新しいデバイスを登録してさらなる足がかりを得られます。",[541,1134,1135,1138],{},[607,1136,1137],{},"Intuneでデバイスにコンプライアンスポリシーが割り当てられていない場合に、デバイスコンプライアンスを不準拠とする設定にしてください。"," 既定では、実際にはポリシーが適用されていなくても各デバイスはコンプライアンス準拠と見なされます。これを変更し、デバイスコンプライアンスポリシーを必須にしてください。",[534,1140,1141,1142,1146],{},"長期的には、Windows Hello for Businessやパスキー（macOS Platform SSOによるPlatform Credentialsを含む）のような、パスワードレスでフィッシング耐性のある認証の展開に投資されることをお勧めします。そうすることで、その後フィッシング耐性のある認証を強制し、AiTM攻撃を遮断できるようになります。パスワードの代わりに、新しいデバイスや従業員のオンボーディングなど、期間とシナリオを限定してTemporary Access Pass（TAP）の利用を許可してください。さまざまなユースケースでTAPを活用できるよう、当社は",[545,1143,287],{"href":1144,"rel":1145},"https://myworkid.cloud/",[549],"を開発しました。",[530,1148,1149],{"id":1149},"まとめ",[534,1151,536],{},[534,1153,1154],{},"Entra IDのゼロトラストエンジンである条件付きアクセスは、それ自体がすでに複雑です。さらにMicrosoftがEntraのバックエンドに組み込んだ除外設定によって、ポリシーや保護の効果を理解することは多くの人にとって一層難しくなっています。それでも、ゼロトラストと多層防御という考え方は有効なままです。",[534,1156,1157],{},"デバイスコンプライアンスポリシーはほとんどのAiTM攻撃を防ぎ、多要素認証（MFA）は、漏えいしたりその他の形で侵害されたりした資格情報の悪用を攻撃者にとって難しくします。",[534,1159,1160],{},"これらのセキュリティ対策は、どれか一方を他方の代わりにするのではなく、組み合わせて使わなければなりません。そうすることで、防御のひとつが改ざんされたり突破されたりしても、安全な環境を維持できます。",[534,1162,1163],{},"悪用の可能性を確実に検知できるよう、ここで示した検知をMicrosoft Defender XDRに展開することを強くお勧めします。自社のSOCがこうしたインシデントを調査できる体制を整え、必要なプレイブックを用意しておいてください。",{"title":1165,"searchDepth":1166,"depth":1166,"links":1167},"",2,[1168,1169,1170,1174,1180,1181,1182,1183],{"id":532,"depth":1166,"text":532},{"id":593,"depth":1166,"text":594},{"id":640,"depth":1166,"text":640,"children":1171},[1172],{"id":646,"depth":1173,"text":647},3,{"id":732,"depth":1166,"text":732,"children":1175},[1176,1177,1178,1179],{"id":737,"depth":1173,"text":738},{"id":768,"depth":1173,"text":696},{"id":801,"depth":1173,"text":707},{"id":809,"depth":1173,"text":810},{"id":823,"depth":1166,"text":823},{"id":1000,"depth":1166,"text":1000},{"id":1048,"depth":1166,"text":1048},{"id":1149,"depth":1166,"text":1149},"md","post",{"lang":1187,"seoTitle":1188,"titleClass":1189,"date":1190,"categories":1191,"blogtitlepic":1192,"socialimg":1193,"customExcerpt":1194,"keywords":1195,"contactInContent":1196,"scripts":1253},"ja","Microsoft IntuneのCompliant Device Bypass: 検知、対応、緩和","h2-font-size","2025-01-14",[235],"header-company-portal-ca-bypass","/blog/heads/header-company-portal-ca-bypass.png","本記事では、glueckkanjaのMVPであるFabian Bader、Chris Brumm、Thomas NaunheimがMicrosoft Intune Company PortalのCompliant Device Bypassについて詳しく解説します。追加の調査により、この潜在的な脅威を検知し対応するための手法を見つけ出しました。攻撃対象領域を減らすための条件付きアクセスの指針と、影響範囲（blast radius）の詳細もあわせてご紹介します。","Compliant Device Bypass, Microsoft Intune, 条件付きアクセス, Entra ID, Intune Company Portal, デバイスコンプライアンス, CAの除外, TokenSmith PoC, クラウドセキュリティ, PowerShell PoC, Fabian Bader, Christopher Brumm, Thomas Naunheim, セキュリティ脅威, Black Hat Europe, Intune Enrollment, MSRCの回答, 攻撃の検知, 脅威の緩和, クラウドのコンプライアンス, FOCI機能",{"quote":484,"infos":1197},{"bgColor":1198,"color":1199,"boxBgColor":1200,"boxColor":1201,"headline":1202,"subline":1203,"level":530,"textStyling":1204,"flush":1205,"person":1206,"form":1218},"var(--color-gk-violet)","var(--color-gk-white)","var(--color-gk-yellow)","var(--color-copy)","今すぐご相談ください","Compliant Device Bypassと、その効果的な検知・緩和の方法について詳しくお知りになりたいですか。当社の専門家が調査結果をご説明し、セキュリティ強化に向けた実証済みの戦略でご支援します。皆様とお話しできることを楽しみにしています。","text-light","justify-content-end",{"image":1207,"cloudinary":325,"alt":1208,"name":1208,"detailsHeader":1209,"details":1210},"/people/people-pam-team.png","Project & Account Management","皆様からのご連絡をお待ちしています",[1211,1215],{"text":492,"href":1212,"details":1213,"icon":1214},"tel:+49 69 4005520","今すぐ電話する","site/phone",{"text":493,"href":1216,"icon":1217},"mailto:info@glueckkanja.com","site/mail",{"ctaText":1219,"cta":1220,"method":1185,"action":1222,"fields":1223},"送信",{"skin":1221},"primary on-surface","/send",[1224,1228,1233,1236,1240,1245,1248,1251],{"type":1225,"id":1226,"value":1227},"hidden","_next","successful",{"label":1229,"type":1230,"id":1231,"required":325,"requiredMsg":1232},"お名前*","text","name","お名前を入力してください",{"label":1234,"type":1230,"id":403,"required":325,"requiredMsg":1235},"会社名*","会社名をご記入ください",{"label":1237,"type":1238,"id":1238,"required":325,"requiredMsg":1239},"メールアドレス*","email","メールアドレスを入力してください",{"label":1241,"type":1242,"id":1243,"required":325,"requiredMsg":1244},"ご入力いただいたデータは、お問い合わせの処理と回答のために当社で保存されます。データ保護に関する詳細は\u003Ca href=\"/ja/privacy\">プライバシーポリシー\u003C/a>をご覧ください。","checkbox","dataprotection","ご確認ください",{"type":1225,"id":1246,"value":1247},"_subject","Request Global Secure Access",{"type":1225,"id":1249,"value":1250},"inbox_key","gkgab-contact-form",{"type":1225,"id":1252},"_gotcha",{"slick":325,"form":325},"/posts/2025-01-14-compliant-device-bypass",{"title":521,"description":1165},"posts/2025-01-14-compliant-device-bypass",[235,1258,1259,1260,281],"Entra","Conditional Access","ITDR","sy32hQ4l98na4Cpln-J8l23KMR3xkua_vk9ZxB030UA",{"id":1263,"extension":1264,"meta":1265,"stem":8,"__hash__":1613},"authors_data/authors.json","json",{"path":1266,"Fritz Zurhorst":1267,"Alexander Schlindwein":1273,"Sophie Luna":1279,"Nadine Klein":1287,"Karsten Kleinschmidt":1293,"Julian Wendt":1301,"Holger Bunkradt":1306,"Ralf Mania":1312,"Oliver Kieselbach":1318,"Steffen Schwerdtfeger":1324,"Gunnar Winter":1332,"Jan Petersen":1337,"Thorsten Kunzi":1342,"Moritz Pohl":1346,"Thorben Pöschus":1351,"Christoph Hannebauer":1357,"Marco Scheel":1361,"Christopher Brumm":1366,"Florian Klante":1372,"Niklas Bachmann":1377,"Nils Krautkrämer":1382,"Patrick Treptau":1388,"Peter Beckendorf":1393,"Patrick Sobau":1398,"Jörg Wunderlich":1403,"Michael Breither":1407,"Christian Kanja":1412,"Zeba Hoffmann":1418,"Jochen Fröhlich":1423,"Jan Geisbauer":1427,"Gerrit Reinke":1439,"Christian Kordel":1445,"Stephan Wälde":1449,"Carolin Kanja":1454,"Adrian Ritter":1460,"Marvin Bangert":1465,"Thorsten Pickhan":1471,"Christian Lorenz":1477,"Denis Böhm":1482,"Fabian Bader":1487,"Juan Jose Fernandez Perez":1492,"Mahschid Sayyar":1497,"Benjamin Dassow":1502,"Markus Walschburger":1507,"Jonathan Haist":1512,"Daniel Rohregger":1517,"Thomas Naunheim":1522,"Florian Stöckl":1526,"Pascal Asch":1531,"Markus Kättner":1536,"Anna Ulbricht":1543,"Annette Brauns":1550,"body":1556,"title":1612},"/authors",{"display_name":1268,"avatar":1269,"permalink":1270,"linkedin":1271,"imageOffsetTop":1272},"Fritz Zurhorst","people/people-fritz-zurhorst.png","/authors/fritz-zurhorst","friedemann-z","72%",{"display_name":1274,"avatar":1275,"permalink":1276,"twitter":1277,"linkedin":1278},"Alexander Schlindwein","people/people-alexander-rudolph.png","/authors/alexander-schlindwein","AlexanderOnIT","schlindwein-alexander",{"display_name":1280,"avatar":1281,"permalink":1282,"twitter":1283,"linkedin":1284,"imageOffsetLeft":1285,"imageOffsetTop":1286},"Sophie Luna","people/people-sophie-luna.jpg","/authors/sophie-luna","glueckkanjagab","../company/glueckkanja-gab","58%","67%",{"display_name":1288,"avatar":1289,"permalink":1290,"twitter":1291,"linkedin":1292,"imageOffsetTop":1272},"Nadine Klein","people/people-nadine-kern.png","/authors/nadine-kern","nadineausRT","nadine-kern",{"display_name":1294,"avatar":1295,"permalink":1296,"twitter":1297,"linkedin":1298,"imageOffsetTop":1299,"imageOffsetLeft":1300},"Karsten Kleinschmidt","/c_pad,w_800,h_700/people/karsten-kleinschmidt.jpg","/authors/karsten-kleinschmidt","KarstenonIT","karstenkleinschmidt","60%","57%",{"display_name":1302,"avatar":1303,"permalink":1304,"linkedin":1305},"Julian Wendt","people/people-julian-wendt.png","/authors/julian-wendt","julian-wendt",{"display_name":1307,"avatar":1308,"permalink":1309,"linkedin":1310,"twitter":1311},"Holger Bunkradt","people/people-holger-bunkradt.png","/authors/holger-bunkradt","holger-bunkradt-12b5053b","hbunkradt",{"display_name":1313,"avatar":1314,"permalink":1315,"linkedin":1316,"twitter":1317},"Ralf Mania","people/people-ralf-mania.png","/authors/ralf-mania","ralf-mania-146a2757","RaMa1976",{"display_name":1319,"avatar":1320,"permalink":1321,"linkedin":1322,"twitter":1323},"Oliver Kieselbach","people/people-oliver-kieselbach.png","/authors/oliver-kieselbach","oliver-kieselbach-a4a3409","okieselbT",{"display_name":1325,"avatar":1326,"permalink":1327,"linkedin":1328,"twitter":1329,"imageOffsetTop":1330,"imageOffsetLeft":1331},"Steffen Schwerdtfeger","people/people-steffen-schwerdtfeger.png","/authors/steffen-schwerdtfeger","steffen-schwerdtfeger","SteffenAtCloud","79%","51%",{"display_name":1333,"avatar":1334,"permalink":1335,"twitter":1283,"linkedin":1336},"Gunnar Winter","people/people-gunnar-winter.jpg","/authors/gunnar-winter","company/glueckkanja-gab",{"display_name":1338,"avatar":1339,"permalink":1340,"twitter":1283,"linkedin":1341},"Jan Petersen","people/jan-petersen.png","/authors/jan-petersen","jan-petersen-26a901",{"display_name":1343,"avatar":1344,"permalink":1345,"twitter":1283,"linkedin":1336,"imageOffsetTop":1272},"Thorsten Kunzi","people/author-thorsten-kunzi.png","/authors/thorsten-kunzi",{"display_name":1347,"avatar":1348,"permalink":1349,"twitter":1283,"linkedin":1350},"Dr. Moritz Pohl","people/people-moritz-pohl.png","/authors/moritz-pohl","dr-moritz-pohl",{"display_name":1352,"avatar":1353,"permalink":1354,"twitter":1355,"linkedin":1356},"Thorben Pöschus","people/thorben.poeschus.png","/authors/thorben-poeschus","TPO901","thorben-pöschus-624693b7",{"display_name":1358,"avatar":1359,"permalink":1360,"twitter":1283,"linkedin":1336,"imageOffsetTop":1272},"Dr. Christoph Hannebauer","people/people-christoph-hannebauer.png","/authors/christoph-hannebauer",{"display_name":1362,"avatar":1363,"permalink":1364,"twitter":1365,"linkedin":1365},"Marco Scheel","people/people-marco-scheel.png","/authors/marco-scheel","marcoscheel",{"display_name":524,"avatar":1367,"permalink":1368,"twitter":1369,"linkedin":1370,"imageOffsetTop":1371},"people/people-christopher-brumm.jpg","/authors/christopher-brumm","cbrhh","christopherbrumm","66%",{"display_name":1373,"avatar":1374,"permalink":1375,"linkedin":1376,"twitter":1283},"Florian Klante","people/florian-klante.jpg","/authors/florian-klante","florian-klante-6031b31b",{"display_name":1378,"avatar":1379,"permalink":1380,"linkedin":1381,"twitter":1283},"Niklas Bachmann","people/niklas.bachmann.png","/authors/niklas-bachmann","niklas-bachmann-66a863158",{"display_name":1383,"avatar":1384,"permalink":1385,"twitter":1386,"linkedin":1387},"Nils Krautkrämer","people/nils-krautkraemer.png","/authors/nils-krautkraemer","KrauNils","nils-krautkrämer-8b04bb250",{"display_name":1389,"avatar":1390,"permalink":1391,"linkedin":1392,"twitter":1283},"Patrick Treptau","people/people-patrick-treptau.png","/authors/patrick-traptau","ptreptau",{"display_name":1394,"avatar":1395,"permalink":1396,"linkedin":1397,"twitter":1283,"imageOffsetTop":1272},"Peter Beckendorf","people/peter-beckendorf.png","/authors/peter-beckendorf","peter-beckendorf-29a239b1",{"display_name":1399,"avatar":1400,"permalink":1401,"linkedin":1402,"twitter":1283},"Patrick Sobau","people/patrick-sobau.png","/authors/patrick-sobau","patrick-sobau",{"display_name":1404,"avatar":1405,"permalink":1406,"twitter":1283},"Jörg Wunderlich","people/joerg-wunderlich.png","/authors/joerg-wunderlich",{"display_name":1408,"avatar":1409,"permalink":1410,"twitter":1283,"linkedin":1411},"Michael Breither","people/people-michael-breither.jpg","/authors/michael-breither","michaelbreither",{"display_name":1413,"avatar":1414,"permalink":1415,"twitter":1416,"linkedin":1417},"Christian Kanja","people/people-christian-kanja.png","/authors/christian-kanja","cekageka","christian-kanja",{"display_name":1419,"avatar":1420,"permalink":1421,"linkedin":1422,"twitter":1283},"Zeba Hoffmann","people/zeba-hoffmann.png","/authors/zeba-hoffmann","zebahoffmann",{"display_name":1424,"avatar":1425,"permalink":1426,"twitter":1283,"linkedin":1336},"Jochen Fröhlich","people/people-jochen-froehlich.png","/authors/jochen-froehlich",{"display_name":1428,"avatar":1429,"permalink":1430,"twitter":1431,"linkedin":1431,"imageOffsetTop":1272,"socials":1432},"Jan Geisbauer","people/people-jan-geisbauer-csoc.png","/authors/jan-geisbauer","JanGeisbauer",[1433,1436],{"text":1434,"href":1435},"Blog","https://emptydc.com",{"text":1437,"href":1438},"Podcast","https://hairlessinthecloud.com",{"display_name":1440,"avatar":1441,"permalink":1442,"twitter":1443,"linkedin":1444},"Gerrit Reinke","people/gerrit-reinke.png","/authors/gerrit-reinke","GLWRe","glwr",{"display_name":1446,"avatar":1447,"permalink":1448,"twitter":1283,"linkedin":1336},"Christian Kordel","people/christian-kordel.png","/authors/christian-kordel",{"display_name":1450,"avatar":1451,"permalink":1452,"twitter":1453,"linkedin":1336},"Stephan Wälde","people/people-stephan-waelde.png","/authors/stephan-waelde","stephanwaelde",{"display_name":1455,"avatar":1456,"permalink":1457,"twitter":1458,"linkedin":1459},"Carolin Kanja","people/people-carolin-kanja.jpg","/authors/carolin-kanja","fraukanja","carolin-kanja",{"display_name":1461,"avatar":1462,"permalink":1463,"twitter":1464,"linkedin":1464},"Adrian Ritter","people/people-adrian-ritter.png","/authors/adrian-ritter","adrianritter",{"display_name":1466,"avatar":1467,"permalink":1468,"twitter":1469,"linkedin":1470},"Marvin Bangert","people/people-marvin-bangert.png","/authors/marvin-bangert","marvinbangert","marvin-bangert",{"display_name":1472,"avatar":1473,"permalink":1474,"twitter":1475,"linkedin":1476},"Thorsten Pickhan","people/people-thorsten-pickhan.png","/authors/thorsten-pickhan","tpickhan","thorsten-pickhan",{"display_name":1478,"avatar":1479,"permalink":1480,"linkedin":1481,"twitter":1283},"Christian Lorenz","people/people-christian-lorenz.png","/authors/christian-lorenz","christianlorenz95",{"display_name":1483,"avatar":1484,"permalink":1485,"linkedin":1486,"twitter":1283},"Denis Böhm","people/people-denis-boehm.png","/authors/denis-boehm","denis-böhm-3bb834135",{"display_name":523,"avatar":1488,"permalink":1489,"linkedin":1490,"twitter":1491},"people/people-fabian-bader.jpg","/authors/fabian-bader","fabianbader","fabian_bader",{"display_name":1493,"avatar":1494,"permalink":1495,"linkedin":1496},"Juan Jose Fernandez Perez","people/people-juan-jose-fernandez.jpg","/authors/juan-jose-fernandez-perez","juan-jose-fernandez-perez-8016055",{"display_name":1498,"avatar":1499,"permalink":1500,"linkedin":1501},"Mahschid Sayyar","people/people-mahschid-sayyar.jpg","/authors/mahschid-sayyar","mahschid-sayyar-97544463",{"display_name":1503,"avatar":1504,"permalink":1505,"linkedin":1506},"Benjamin Dassow","people/people-benjamin-dassow.jpg","/authors/benjamin-dassow","benjamin-dassow",{"display_name":1508,"avatar":1509,"permalink":1510,"linkedin":1511},"Markus Walschburger","people/people-markus-walschburger.jpg","/authors/markus-walschburger","markus-walschburger",{"display_name":1513,"avatar":1514,"permalink":1515,"linkedin":1516,"imageOffsetTop":1272},"Jonathan Haist","people/people-jonathan-haist.jpg","/authors/jonathan-haist","jonathanhaist",{"display_name":1518,"avatar":1519,"permalink":1520,"linkedin":1521,"imageOffsetTop":1272},"Daniel Rohregger","people/people-daniel-rohregger.jpg","/authors/daniel-rohregger","drohregger",{"display_name":525,"avatar":1523,"permalink":1524,"linkedin":1525,"imageOffsetTop":1371},"people/people-thomas-naunheim.jpg","/authors/thomas-naunheim","thomasnaunheim",{"display_name":1527,"avatar":1528,"permalink":1529,"linkedin":1530,"imageOffsetTop":1371},"Florian Stöckl","people/people-florian-stoeckl.jpg","/authors/florian-stoeckl","florianstoeckl",{"display_name":1532,"avatar":1533,"permalink":1534,"linkedin":1535,"imageOffsetTop":1371},"Pascal Asch","people/Pascal.Asch.648.jpg","/authors/pascal-asch","pascal-asch",{"display_name":1537,"avatar":1538,"permalink":1539,"linkedin":1540,"imageOffsetTop":1541,"imageOffsetLeft":1542},"Markus Kättner","people/markus-kaettner.jpg","/authors/markus-kaettner","markus-kättner-b600119","62%","63%",{"display_name":1544,"avatar":1545,"permalink":1546,"linkedin":1547,"imageOffsetTop":1548,"imageOffsetLeft":1549},"Anna Ulbricht","people/anna-katharina.ulbricht-09.png","/authors/anna-ulbricht","anna-katharina-u-a67702199","70%","50%",{"display_name":1551,"avatar":1552,"permalink":1553,"linkedin":1554,"imageOffsetTop":1555,"imageOffsetLeft":1299},"Annette Brauns","people/Annette-Brauns-8.jpg","/authors/annette-brauns","annette-brauns","95%",{"Fritz Zurhorst":1557,"Alexander Schlindwein":1558,"Sophie Luna":1559,"Nadine Klein":1560,"Karsten Kleinschmidt":1561,"Julian Wendt":1562,"Holger Bunkradt":1563,"Ralf Mania":1564,"Oliver Kieselbach":1565,"Steffen Schwerdtfeger":1566,"Gunnar Winter":1567,"Jan Petersen":1568,"Thorsten Kunzi":1569,"Moritz Pohl":1570,"Thorben Pöschus":1571,"Christoph Hannebauer":1572,"Marco Scheel":1573,"Christopher Brumm":1574,"Florian Klante":1575,"Niklas Bachmann":1576,"Nils Krautkrämer":1577,"Patrick Treptau":1578,"Peter Beckendorf":1579,"Patrick Sobau":1580,"Jörg Wunderlich":1581,"Michael Breither":1582,"Christian Kanja":1583,"Zeba Hoffmann":1584,"Jochen Fröhlich":1585,"Jan Geisbauer":1586,"Gerrit Reinke":1590,"Christian Kordel":1591,"Stephan Wälde":1592,"Carolin Kanja":1593,"Adrian Ritter":1594,"Marvin Bangert":1595,"Thorsten Pickhan":1596,"Christian Lorenz":1597,"Denis Böhm":1598,"Fabian Bader":1599,"Juan Jose Fernandez Perez":1600,"Mahschid Sayyar":1601,"Benjamin Dassow":1602,"Markus Walschburger":1603,"Jonathan Haist":1604,"Daniel Rohregger":1605,"Thomas Naunheim":1606,"Florian Stöckl":1607,"Pascal Asch":1608,"Markus Kättner":1609,"Anna Ulbricht":1610,"Annette Brauns":1611},{"display_name":1268,"avatar":1269,"permalink":1270,"linkedin":1271,"imageOffsetTop":1272},{"display_name":1274,"avatar":1275,"permalink":1276,"twitter":1277,"linkedin":1278},{"display_name":1280,"avatar":1281,"permalink":1282,"twitter":1283,"linkedin":1284,"imageOffsetLeft":1285,"imageOffsetTop":1286},{"display_name":1288,"avatar":1289,"permalink":1290,"twitter":1291,"linkedin":1292,"imageOffsetTop":1272},{"display_name":1294,"avatar":1295,"permalink":1296,"twitter":1297,"linkedin":1298,"imageOffsetTop":1299,"imageOffsetLeft":1300},{"display_name":1302,"avatar":1303,"permalink":1304,"linkedin":1305},{"display_name":1307,"avatar":1308,"permalink":1309,"linkedin":1310,"twitter":1311},{"display_name":1313,"avatar":1314,"permalink":1315,"linkedin":1316,"twitter":1317},{"display_name":1319,"avatar":1320,"permalink":1321,"linkedin":1322,"twitter":1323},{"display_name":1325,"avatar":1326,"permalink":1327,"linkedin":1328,"twitter":1329,"imageOffsetTop":1330,"imageOffsetLeft":1331},{"display_name":1333,"avatar":1334,"permalink":1335,"twitter":1283,"linkedin":1336},{"display_name":1338,"avatar":1339,"permalink":1340,"twitter":1283,"linkedin":1341},{"display_name":1343,"avatar":1344,"permalink":1345,"twitter":1283,"linkedin":1336,"imageOffsetTop":1272},{"display_name":1347,"avatar":1348,"permalink":1349,"twitter":1283,"linkedin":1350},{"display_name":1352,"avatar":1353,"permalink":1354,"twitter":1355,"linkedin":1356},{"display_name":1358,"avatar":1359,"permalink":1360,"twitter":1283,"linkedin":1336,"imageOffsetTop":1272},{"display_name":1362,"avatar":1363,"permalink":1364,"twitter":1365,"linkedin":1365},{"display_name":524,"avatar":1367,"permalink":1368,"twitter":1369,"linkedin":1370,"imageOffsetTop":1371},{"display_name":1373,"avatar":1374,"permalink":1375,"linkedin":1376,"twitter":1283},{"display_name":1378,"avatar":1379,"permalink":1380,"linkedin":1381,"twitter":1283},{"display_name":1383,"avatar":1384,"permalink":1385,"twitter":1386,"linkedin":1387},{"display_name":1389,"avatar":1390,"permalink":1391,"linkedin":1392,"twitter":1283},{"display_name":1394,"avatar":1395,"permalink":1396,"linkedin":1397,"twitter":1283,"imageOffsetTop":1272},{"display_name":1399,"avatar":1400,"permalink":1401,"linkedin":1402,"twitter":1283},{"display_name":1404,"avatar":1405,"permalink":1406,"twitter":1283},{"display_name":1408,"avatar":1409,"permalink":1410,"twitter":1283,"linkedin":1411},{"display_name":1413,"avatar":1414,"permalink":1415,"twitter":1416,"linkedin":1417},{"display_name":1419,"avatar":1420,"permalink":1421,"linkedin":1422,"twitter":1283},{"display_name":1424,"avatar":1425,"permalink":1426,"twitter":1283,"linkedin":1336},{"display_name":1428,"avatar":1429,"permalink":1430,"twitter":1431,"linkedin":1431,"imageOffsetTop":1272,"socials":1587},[1588,1589],{"text":1434,"href":1435},{"text":1437,"href":1438},{"display_name":1440,"avatar":1441,"permalink":1442,"twitter":1443,"linkedin":1444},{"display_name":1446,"avatar":1447,"permalink":1448,"twitter":1283,"linkedin":1336},{"display_name":1450,"avatar":1451,"permalink":1452,"twitter":1453,"linkedin":1336},{"display_name":1455,"avatar":1456,"permalink":1457,"twitter":1458,"linkedin":1459},{"display_name":1461,"avatar":1462,"permalink":1463,"twitter":1464,"linkedin":1464},{"display_name":1466,"avatar":1467,"permalink":1468,"twitter":1469,"linkedin":1470},{"display_name":1472,"avatar":1473,"permalink":1474,"twitter":1475,"linkedin":1476},{"display_name":1478,"avatar":1479,"permalink":1480,"linkedin":1481,"twitter":1283},{"display_name":1483,"avatar":1484,"permalink":1485,"linkedin":1486,"twitter":1283},{"display_name":523,"avatar":1488,"permalink":1489,"linkedin":1490,"twitter":1491},{"display_name":1493,"avatar":1494,"permalink":1495,"linkedin":1496},{"display_name":1498,"avatar":1499,"permalink":1500,"linkedin":1501},{"display_name":1503,"avatar":1504,"permalink":1505,"linkedin":1506},{"display_name":1508,"avatar":1509,"permalink":1510,"linkedin":1511},{"display_name":1513,"avatar":1514,"permalink":1515,"linkedin":1516,"imageOffsetTop":1272},{"display_name":1518,"avatar":1519,"permalink":1520,"linkedin":1521,"imageOffsetTop":1272},{"display_name":525,"avatar":1523,"permalink":1524,"linkedin":1525,"imageOffsetTop":1371},{"display_name":1527,"avatar":1528,"permalink":1529,"linkedin":1530,"imageOffsetTop":1371},{"display_name":1532,"avatar":1533,"permalink":1534,"linkedin":1535,"imageOffsetTop":1371},{"display_name":1537,"avatar":1538,"permalink":1539,"linkedin":1540,"imageOffsetTop":1541,"imageOffsetLeft":1542},{"display_name":1544,"avatar":1545,"permalink":1546,"linkedin":1547,"imageOffsetTop":1548,"imageOffsetLeft":1549},{"display_name":1551,"avatar":1552,"permalink":1553,"linkedin":1554,"imageOffsetTop":1555,"imageOffsetLeft":1299},"Authors","1csawlkJxRljy93GTOnXEkwLqAv9Lcj-apxRvoodAOY",{"list":1615,"authors":1832},[1616,1633,1647,1661,1677,1690,1703,1716,1728,1744,1758,1773,1791,1802,1816],{"id":1617,"title":1618,"author":1619,"cta":494,"description":1165,"hideInRecent":484,"layout":1185,"meta":1620,"moment":1625,"path":1626,"stem":1627,"tags":1628,"webcast":484},"content_ja/posts/2026-09-22-end-of-mfa-sms.md","MFA向けSMSの終わり",[1294],{"lang":1187,"date":1621,"categories":1622,"blogtitlepic":1623,"customExcerpt":1624},"2026-09-21",[235],"head-conditional-access.jpg","企業がいまフィッシング耐性のある、できるだけパスワードレスな認証方式へ移行すべき理由。","2026-09-22","/posts/2026-09-22-end-of-mfa-sms","posts/2026-09-22-end-of-mfa-sms",[235,1629,1630,1631,1632],"Authentication","Microsoft Entra ID","MFA","Passkeys",{"id":1634,"title":1635,"author":1636,"cta":494,"description":1165,"hideInRecent":484,"layout":1185,"meta":1637,"moment":1621,"path":1641,"stem":1642,"tags":1643,"webcast":484},"content_ja/posts/2026-09-21-clickfix-prevent-detect.md","ClickFix。ユーザー自身がエクスプロイトになるとき、そしてそれを止める方法",[1268,1288],{"lang":1187,"date":1621,"categories":1638,"blogtitlepic":1639,"customExcerpt":1640},[235],"head-clickfix.jpg","ClickFixはユーザーを自分自身への攻撃者に変えます。偽のCAPTCHA、コピー＆ペースト、そして悪意あるコードがメモリ上で走り、ディスクには何も残りません。Microsoft Defenderがこの攻撃をどう検知するのか、検知はどこで限界に達するのか、そしてRunMRUハントと4つの防御レイヤーでその隙間をどう埋めるのかを解説します。","/posts/2026-09-21-clickfix-prevent-detect","posts/2026-09-21-clickfix-prevent-detect",[1644,1645,1646],"Defender","SOC","Endpoint Security",{"id":1648,"title":1649,"author":1650,"cta":494,"description":1165,"hideInRecent":484,"layout":1185,"meta":1651,"moment":1621,"path":1655,"stem":1656,"tags":1657,"webcast":484},"content_ja/posts/2026-09-21-red-tenant-dark-tenant-cio.md","管理業務と日常業務を1台のPCで。Game Overです。",[1428],{"lang":1187,"date":1621,"categories":1652,"blogtitlepic":1653,"customExcerpt":1654},[235],"head-game-over-en.jpg","CIOにとってテナントが1つでは足りない理由と、2つ目がめったに検討されない理由。Managed Red Tenantは管理業務をオフィス環境からアーキテクチャとして分離し、Managed Dark Tenantは防御が破られてもなお組織が動き続けられるようにします。それが運用モデル、SOCのシグナル、そしてNISG 2026による証明義務にとって何を意味するのかを解説します。","/posts/2026-09-21-red-tenant-dark-tenant-cio","posts/2026-09-21-red-tenant-dark-tenant-cio",[235,1658,1659,1660],"Privileged Access","Zero Trust","NIS2",{"id":1662,"title":1663,"author":1664,"cta":494,"description":1665,"hideInRecent":484,"layout":1185,"meta":1666,"moment":1667,"path":1672,"stem":1673,"tags":1674,"webcast":484},"content_ja/posts/2026-08-08-isg-germany-2026.md","4度のLeader。ISGドイツ調査2026のglueckkanja",[1455],"ISGは今年、調査の名称を変更しました。Microsoft Cloud EcosystemはMicrosoft AI and Cloud Ecosystemになり、名称とともに評価の尺度も移りました。問われるのはもはや、誰がMicrosoftプラットフォームを導入したかではなく、誰がCopilot、エージェント、AIワークロードを制御可能なかたちで運用しているかです。この新しい尺度によって当社の位置づけが変わることはありませんでした。ISG Provider Lens®調査ドイツ2026は、当社を4つのクアドラントでLeaderに位置づけています。Microsoft Productivity and Business Process ServicesとAzure Managed Servicesの、それぞれLarge MarketとMid Marketです。2021年、2023年、2024年、2025年に続き、ドイツでは5回目のLeader評価となります。スイスでのLeaderクアドラント入りはその2週間前でした。",{"lang":1187,"date":1667,"categories":1668,"blogtitlepic":1670,"customExcerpt":1671},"2026-08-08",[1669],"Corporate","head-isg-de-2026.png","ISG Provider Lens®調査2026は、ドイツにおいてglueckkanjaを4つのクアドラントでLeaderに位置づけました。Microsoft Productivity and Business Process ServicesとAzure Managed Servicesの、それぞれLarge MarketとMid Marketです。調査の名称はMicrosoft AI and Cloud Ecosystemに変わり、評価の尺度も移りました。AIとエージェントのワークロードを制御可能なかたちで運用できるかが問われています。","/posts/2026-08-08-isg-germany-2026","posts/2026-08-08-isg-germany-2026",[1675,1676],"Award","ISG",{"id":1678,"title":1679,"author":1680,"cta":494,"description":1681,"hideInRecent":484,"layout":1185,"meta":1682,"moment":1683,"path":1687,"stem":1688,"tags":1689,"webcast":484},"content_ja/posts/2026-07-31-isg-switzerland-2026.md","Rising StarからLeaderへ。ISGスイス調査2026のglueckkanja",[1455],"2024年に当社はglueckkanja Switzerland AGを設立し、ベルンのBahnhofplatz 10bにあるzentroomにオフィスを構えました。2025年、ISGはスイス市場で当社をRising Starに位置づけました。アナリストがLeaderクアドラントへの躍進を見込むベンダーという位置づけです。その躍進がいま記録されました。ISG Provider Lens®調査2026は、スイスにおいて当社をMicrosoft AI and Cloud Ecosystemクアドラントの、Azure Managed Services領域とMicrosoft Productivity and Business Process Services領域でLeaderに位置づけています。",{"lang":1187,"date":1683,"categories":1684,"blogtitlepic":1685,"customExcerpt":1686},"2026-07-31",[1669],"head-isg-ch-2026.png","ISG Provider Lens®調査2026は、スイスにおいてglueckkanjaをMicrosoft AI and Cloud Ecosystemクアドラントの、Azure Managed Services領域とMicrosoft Productivity and Business Process Services領域でLeaderに位置づけました。ベルンでの市場参入から2年、Rising Star選出から1年でのことです。","/posts/2026-07-31-isg-switzerland-2026","posts/2026-07-31-isg-switzerland-2026",[1675,1676],{"id":1691,"title":1692,"author":1693,"cta":494,"description":1165,"hideInRecent":484,"layout":1185,"meta":1694,"moment":1695,"path":1699,"stem":1700,"tags":1701,"webcast":484},"content_ja/posts/2026-07-24-outbreak-openai-hugging-face.md","Outbreak。OpenAI／Hugging Faceの事案が示すこと、示さないこと",[1428],{"lang":1187,"date":1695,"categories":1696,"blogtitlepic":1697,"customExcerpt":1698},"2026-07-24",[235],"head-outbreak.jpg","AIエージェントがテスト環境から脱出し、ゼロデイを見つけ、別の企業をハッキングする。映画の脚本のようですが、2026年7月に実際に起きました。冷静に位置づける時期です。少しの心理学、2人のセキュリティ専門家、そしてそれが自社の防御にとって何を意味するのかという問いとともに。","/posts/2026-07-24-outbreak-openai-hugging-face","posts/2026-07-24-outbreak-openai-hugging-face",[1702,1645,1659],"AI",{"id":1704,"title":1705,"author":1706,"cta":494,"description":1707,"hideInRecent":484,"layout":1185,"meta":1708,"moment":1709,"path":1713,"stem":1714,"tags":1715,"webcast":484},"content_ja/posts/2026-07-22-isg-cybersecurity-2026.md","LeaderそしてRising Star。ISGサイバーセキュリティ調査2026のglueckkanja",[1455],"新たに加わったクアドラントで、いきなりLeaderになりました。ISG Provider Lens®調査「Cybersecurity – Services and Solutions 2026」は、ドイツの中堅中小企業向けNext-Gen SOC/MDR Services分野でglueckkanjaをLeaderと位置づけています。Next-Gen SOC/MDR Servicesの全体市場では、ISGは当社をRising Starに選出しました。つまり、今後12か月から24か月のうちにLeaderクアドラントへ躍進するとアナリストが見込むベンダーだということです。",{"lang":1187,"date":1709,"categories":1710,"blogtitlepic":1711,"customExcerpt":1712},"2026-07-22",[1669],"head-isg-cybersecurity-2026.png","ISG Provider Lens®調査 Cybersecurity 2026は、glueckkanjaをNext-Gen SOC/MDR Services（Midmarket）クアドラントのLeaderに選出しました。Next-Gen SOC/MDR Servicesの全体市場では、当社はRising Starです。ISGは当社の平均を上回る成長、Microsoftセキュリティに関する深い専門性、そしてドイツ国内から提供する24時間365日のSOCを評価しています。","/posts/2026-07-22-isg-cybersecurity-2026","posts/2026-07-22-isg-cybersecurity-2026",[1675,1676,235],{"id":1717,"title":1718,"author":1719,"cta":494,"description":1720,"hideInRecent":484,"layout":1185,"meta":1721,"moment":1722,"path":1725,"stem":1726,"tags":1727,"webcast":484},"content_ja/posts/2026-07-06-the-holy-trinity.md","The Holy Trinity：AIが実際に働くために本当に必要なもの",[1455],"ある製造業の企業が、14,000あるSKUのうちどれが実際に利益を生んでいるのかを知りたいと考えました。答えは3つのシステムの中にありますが、それらは一度もデータを1件たりともやり取りしたことがありません。少し前までは、その答えを得るのに3つの部門、2週間、そして相当な善意が必要でした。2026年初頭からは、AIがこの問いに数分で答えられます。データを走査し、関連を結び、推奨を出す。ただし、アクセスできることが前提です。",{"lang":1187,"date":1722,"categories":1723,"blogtitlepic":1724},"2026-07-06",[131],"head-the-holy-trinity","/posts/2026-07-06-the-holy-trinity","posts/2026-07-06-the-holy-trinity",[1702,131],{"id":1729,"title":1730,"author":1731,"cta":494,"description":1732,"hideInRecent":484,"layout":1185,"meta":1733,"moment":1734,"path":1738,"stem":1739,"tags":1740,"webcast":484},"content_ja/posts/2026-07-01-onboarding-process.md","契約書にサインしたあと：当社のオンボーディングはこう進みます",[1544],"オンボーディングは実際どう進むのですか。応募者との会話で繰り返し受ける質問です。オンボーディングがぎくしゃくした経験を持つ人が少なくないからでしょう。だからこそ当社は、最初から安心してもらうことを大切にしています。",{"lang":1187,"date":1734,"categories":1735,"blogtitlepic":1736,"customExcerpt":1737},"2026-07-01",[1669],"Onboarding_Blogheader","契約書にサインが済み、大きな一歩は終わりました。では、ここからどうなるのでしょうか。PreBoardingからチームでの最初の1週間まで、当社のオンボーディングの舞台裏をご案内します。","/posts/2026-07-01-onboarding-process","posts/2026-07-01-onboarding-process",[1741,1742,1743],"Employer Branding","Onboarding","Unternehmenskultur",{"id":1745,"title":1746,"author":1747,"cta":494,"description":1748,"hideInRecent":484,"layout":1185,"meta":1749,"moment":1750,"path":1754,"stem":1755,"tags":1756,"webcast":484},"content_ja/posts/2026-06-26-frontier-partner.md","Microsoft Frontier Partner：当社もその一員です",[1455],"Microsoftのパートナーエコシステムには数多くの表彰がありますが、Frontier Partner Badgeはその成り立ちにおいて他の称号と一線を画します。申請することはできず、Microsoft側の主導で、ごく限られたパートナーに授与されます。対象となるには、1つの領域で秀でるのではなく、複数の領域で同時に実力を示さなければなりません。Microsoftが確認するのは、Cloud & AI Platforms、AI Business Solutions、そしてSecurityにおける実証済みの能力です。つまり対象は、AIを既存のITへの後付けではなく、IDからエンドポイント、そして本番のAI運用までを貫くアーキテクチャの帰結として捉えている企業です。",{"lang":1187,"date":1750,"categories":1751,"blogtitlepic":1752,"customExcerpt":1753},"2026-06-26",[1669],"head-frontier-partner-badge.jpg","最近、Microsoft AI Cloud Partner Programに新たな最高位の称号としてFrontier Partner Badgeが設けられました。Microsoftがこれを授与するのは、ワークプレイスからクラウドプラットフォーム、セキュリティ、そしてAIアプリケーションそのものに至るまで、Microsoftスタック全体でAIプロジェクトを確実に届けられると実績で示した、世界でもごく限られたパートナーだけです。DACH圏でこのグループに属するのは数社にすぎず、当社はそのうちの1社です。","/posts/2026-06-26-frontier-partner","posts/2026-06-26-frontier-partner",[1675,1757,1702],"Microsoft Partner",{"id":1759,"title":1760,"author":1761,"cta":494,"description":1762,"hideInRecent":484,"layout":1185,"meta":1763,"moment":1764,"path":1768,"stem":1769,"tags":1770,"webcast":484},"content_ja/posts/2026-06-09-vair-run.md","チャリティのために160キロ",[1551],"日曜の朝8時30分、マイン川沿いのHolbeinsteg。おそろいのNinjaCatシャツを着た11人の同僚が、Frankfurter Rundenのスタートに並びました。雨も雷鳴も込みです。良いことのために走るという動機は、悪天候でもランニングシューズの紐を結ぶのに十分でした。",{"lang":1187,"date":1764,"categories":1765,"blogtitlepic":1766,"customExcerpt":1767},"2026-06-08",[1669],"frankfurter-runden.png","同僚11人、16周、160キロ、雷雨、そして表彰台。glueckkanjaはFrankfurter Runden 2026に参加し、走った1周ごとにVAIR e.V.へ寄付しました。同団体はオフェンバッハでインクルーシブなスポーツ・カルチャーパークを建設しています。","/posts/2026-06-09-vair-run","posts/2026-06-09-vair-run",[1771,1741,1772],"Top Arbeitgeber","Soziales Engagement",{"id":1774,"title":1775,"author":1776,"cta":494,"description":1777,"hideInRecent":484,"layout":1185,"meta":1778,"moment":1779,"path":1783,"stem":1784,"tags":1785,"webcast":484},"content_ja/posts/2026-04-10-incident-to-intelligence.md","未知のAMOSスティーラーの解剖：アラートから免疫獲得まで数時間",[1532],"当社のSOCでアラートが発報すると、そこから時計が動き始めます。対象となったお客様だけでなく、当社の保護下にあるすべての組織にとってです。現代の脅威環境で最も危険な瞬間はインテリジェンス・ギャップ、つまり新しいマルウェア亜種が最初に投入されてから、業界がその存在を知る日までの時間の窓です。",{"lang":1187,"date":1779,"categories":1780,"blogtitlepic":1781,"customExcerpt":1782},"2026-04-10",[235],"head-amos-stealer.png","これまで文書化されていなかったAMOSスティーラーの亜種が、macOSエンドポイントを侵害しました。既知のハッシュはなく、公開データベースにC2データもありません。当社のSOCは6層の難読化を解体し、すべての指標を抽出したうえで、業界がこの検体を目にするよりも前に、数時間以内ですべてのSOCのお客様へ保護を配布しました。","/posts/2026-04-10-incident-to-intelligence","posts/2026-04-10-incident-to-intelligence",[1786,1787,1788,1789,1790],"Threat Intelligence","Incident Response","macOS Security","Malware Analysis","Cyber Security Operations Center",{"id":1792,"title":1793,"author":1794,"cta":494,"description":1795,"hideInRecent":484,"layout":1185,"meta":1796,"moment":1797,"path":1800,"stem":1801,"tags":494,"webcast":484},"content_ja/posts/2026-03-21-microsoft-edge-corporate-browser.md","Edgeを唯一の社内標準ブラウザーにすべき理由",[1325],"企業環境におけるブラウザーの選定は戦略的な判断です。セキュリティの水準と運用の手間を直接左右します。長らくGoogle Chromeが自然な選択肢でしたが、Microsoft Edgeは既存のスタックに直接組み込まれるブラウザーへと進化しました。特にMicrosoft 365を利用し、管理をIntuneで行っている環境ではその効果が大きくなります。",{"lang":1187,"date":1797,"blogtitlepic":1798,"customExcerpt":1799},"2026-03-21","head-microsoft-edge-default-browser.jpg","Chromeを本気で選んだ企業はほとんどありません。独自の同期ロジック、独自のアカウント管理、独自のポリシー画面を抱えたまま、ただそこにあっただけです。一方でMicrosoft Edgeは、すでに動いているインフラ、つまりEntra ID、Intune、Defenderに直接組み込まれます。本記事では、移行がどのようなものか、IntuneのポリシーでどのようにChromeをランディングページへリダイレクトするか、そして2つのブラウザーを並行運用するのをやめると何が不要になるかを紹介します。","/posts/2026-03-21-microsoft-edge-corporate-browser","posts/2026-03-21-microsoft-edge-corporate-browser",{"id":1803,"title":1804,"author":1805,"cta":494,"description":1806,"hideInRecent":484,"layout":1185,"meta":1807,"moment":1808,"path":1812,"stem":1813,"tags":1814,"webcast":484},"content_ja/posts/2026-03-20-stryker-attack-intune-privilege.md","必要だったのは管理者アカウント1つだけでした",[1428],"2026年3月11日水曜日。79か国のStrykerのオフィスで従業員がPCの電源を入れると、中身は空でした。ログイン画面はロゴに置き換わっていました。社用ノートPC、社用スマートフォン、そして同社のBYODプログラムに登録されていた私物端末まで、すべてが一夜のうちに同時に消去されました。ランサムウェアもマルウェアのシグネチャも、エンドポイント検知ツールが捉えられるものは何もありませんでした。",{"lang":1187,"date":1808,"categories":1809,"blogtitlepic":1810,"customExcerpt":1811},"2026-03-20",[235],"head-stryker.jpg","2026年3月11日、Handalaは79か国の端末を消去しました。そのために必要だったのは、侵害されたIntuneの管理者アカウント1つだけです。マルウェアもエクスプロイトもなく、正規の管理ツールが所有者自身に向けられました。何が起きたのか、なぜそれが通用したのか、そして塞ぐべき2つのアーキテクチャ上の穴について説明します。","/posts/2026-03-20-stryker-attack-intune-privilege","posts/2026-03-20-stryker-attack-intune-privilege",[1815,71,1658,1659],"Red Tenant",{"id":1817,"title":1818,"author":1819,"cta":494,"description":1820,"hideInRecent":484,"layout":1185,"meta":1821,"moment":1822,"path":1826,"stem":1827,"tags":1828,"webcast":484},"content_ja/posts/2026-03-16-ai-agent-hackathon.md","6つのAgent。4週間。実際の運用へ。",[1455],"自社のIT部門は、Agentなら数分で片づく作業に毎週何時間を費やしているでしょうか。",{"lang":1187,"date":1822,"categories":1823,"blogtitlepic":1824,"customExcerpt":1825},"2026-03-16",[1669],"head-ai-agent-hackathon.jpg","6社、4週間のビルドフェーズ、6つの動作するAI Agent。これが第1回glueckkanja AI Agent Hackathonの成果です。Kiekert、Dr. Oetker、Eckes-Granini、igefa、lila logistikがCopilot StudioでAgentを構築し、それらは現在すでに本番で稼働しています。そこで何が生まれ、この形式がどのように機能するのかを紹介します。","/posts/2026-03-16-ai-agent-hackathon","posts/2026-03-16-ai-agent-hackathon",[1702,1829,1830,1831],"Copilot Studio","Hackathon","AI Agents",{"Karsten Kleinschmidt":1833,"Fritz Zurhorst":1834,"Nadine Klein":1835,"Jan Geisbauer":1836,"Carolin Kanja":1840,"Anna Ulbricht":1841,"Annette Brauns":1842,"Pascal Asch":1843,"Steffen Schwerdtfeger":1844},{"display_name":1294,"avatar":1295,"permalink":1296,"twitter":1297,"linkedin":1298,"imageOffsetTop":1299,"imageOffsetLeft":1300},{"display_name":1268,"avatar":1269,"permalink":1270,"linkedin":1271,"imageOffsetTop":1272},{"display_name":1288,"avatar":1289,"permalink":1290,"twitter":1291,"linkedin":1292,"imageOffsetTop":1272},{"display_name":1428,"avatar":1429,"permalink":1430,"twitter":1431,"linkedin":1431,"imageOffsetTop":1272,"socials":1837},[1838,1839],{"text":1434,"href":1435},{"text":1437,"href":1438},{"display_name":1455,"avatar":1456,"permalink":1457,"twitter":1458,"linkedin":1459},{"display_name":1544,"avatar":1545,"permalink":1546,"linkedin":1547,"imageOffsetTop":1548,"imageOffsetLeft":1549},{"display_name":1551,"avatar":1552,"permalink":1553,"linkedin":1554,"imageOffsetTop":1555,"imageOffsetLeft":1299},{"display_name":1532,"avatar":1533,"permalink":1534,"linkedin":1535,"imageOffsetTop":1371},{"display_name":1325,"avatar":1326,"permalink":1327,"linkedin":1328,"twitter":1329,"imageOffsetTop":1330,"imageOffsetLeft":1331},{"id":1263,"extension":1264,"meta":1846,"stem":8,"__hash__":1613},{"Christopher Brumm":1847,"Fabian Bader":1848,"Thomas Naunheim":1849},{"display_name":524,"avatar":1367,"permalink":1368,"twitter":1369,"linkedin":1370,"imageOffsetTop":1371},{"display_name":523,"avatar":1488,"permalink":1489,"linkedin":1490,"twitter":1491},{"display_name":525,"avatar":1523,"permalink":1524,"linkedin":1525,"imageOffsetTop":1371},1791383935898]