[{"data":1,"prerenderedAt":1855},["ShallowReactive",2],{"sc:header-data-nl":3,"sc:footer-data-nl":489,"post-nl--posts-2025-01-14-compliant-device-bypass-184506556cb284":519,"authors_data":1269,"content-nl-list-7b291c2dd91a4":1620,"authors_data:Christopher Brumm|Fabian Bader|Thomas Naunheim":1850},{"lang":4,"home":5,"navigation":17,"meta":479,"contact":485},"de",{"name":6,"folderSwitch":7,"imgLight":10,"img":11,"languages":12},"home",[8,9],"authors","blog","/logos/gk-Logo-sw.svg","/logos/gk-Logo-rgb.svg",{"nl":13},{"title":14,"url":15,"alt":16},"Home","/nl","glueckkanja Logo",[18,127,231,316,395,402],{"name":19,"languages":20,"children":24},"workplace",{"nl":21},{"title":22,"description":23},"Workplace","Slimme, veilige en flexibele werkplekken op basis van Microsoft 365, waarin moderne technologie en identiteitsdiensten samenkomen.",[25,55,91],{"name":26,"languages":27,"children":30},"portfolio",{"nl":28},{"title":29},"Portfolio",[31,37,43,49],{"name":32,"languages":33},"managed-intune",{"nl":34},{"title":35,"url":36},"Managed Intune","/nl/entra-intune/managed-intune",{"name":38,"languages":39},"managed-entra",{"nl":40},{"title":41,"url":42},"Managed Entra","/nl/entra-intune/managed-entra",{"name":44,"languages":45},"managed-workplace",{"nl":46},{"title":47,"url":48},"Managed Workplace","/nl/workplace/managed-workplace",{"name":50,"languages":51},"consulting-services",{"nl":52},{"title":53,"url":54},"Consulting Services","/nl/workplace/consulting-services",{"name":56,"languages":57,"children":60},"microsoft-365-endpoint",{"nl":58},{"title":59},"Microsoft 365 Endpoint",[61,67,73,79,85],{"name":62,"languages":63},"microsoft-entra-suite",{"nl":64},{"title":65,"url":66},"Microsoft Entra Suite","/nl/workplace/microsoft-entra-suite",{"name":68,"languages":69},"microsoft-intune",{"nl":70},{"title":71,"url":72},"Microsoft Intune","/nl/workplace/microsoft-intune",{"name":74,"languages":75},"microsoft-windows",{"nl":76},{"title":77,"url":78},"Microsoft Windows","/nl/workplace/microsoft-windows",{"name":80,"languages":81},"windows-365-cloud-pc",{"nl":82},{"title":83,"url":84},"Windows 365 Cloud PC","/nl/workplace/windows365-cloud-pc",{"name":86,"languages":87},"cloud-workplace-foundation",{"nl":88},{"title":89,"url":90},"Cloud Workplace Foundation","/nl/workplace/cloud-workplace-foundation",{"name":92,"languages":93,"children":96},"microsoft-365-collaboration",{"nl":94},{"title":95},"Microsoft 365 Collaboration",[97,103,109,115,121],{"name":98,"languages":99},"microsoft-copilot",{"nl":100},{"title":101,"url":102},"Microsoft 365 Copilot","/nl/workplace/microsoft-365-copilot",{"name":104,"languages":105},"microsoft-teams",{"nl":106},{"title":107,"url":108},"Teams","/nl/workplace/microsoft-teams",{"name":110,"languages":111},"sharepoint-powerplatform",{"nl":112},{"title":113,"url":114},"SharePoint & Power Platform","/nl/workplace/sharepoint-power-platform",{"name":116,"languages":117},"exchange-online",{"nl":118},{"title":119,"url":120},"Exchange Online","/nl/workplace/exchange-online",{"name":122,"languages":123},"information-protection-compliance",{"nl":124},{"title":125,"url":126},"Information Protection & Compliance","/nl/workplace/information-protection-compliance",{"name":128,"languages":129,"children":133},"azure",{"nl":130},{"title":131,"description":132},"Azure","Groeien met Azure: lagere cloudkosten, meer efficiëntie en ruimte voor innovatie met IaaS en PaaS.",[134,151,181],{"name":135,"languages":136,"children":138},"azure-portfolio",{"nl":137},{"title":29},[139,145],{"name":140,"languages":141},"azure-managed-services",{"nl":142},{"title":143,"url":144},"Azure Managed Services","/nl/azure/azure-managed-services",{"name":146,"languages":147},"azure-consulting",{"nl":148},{"title":149,"url":150},"Azure Consulting","/nl/azure/azure-consulting",{"name":152,"languages":153,"children":156},"azure-scenarios",{"nl":154},{"title":155},"Scenario's",[157,163,169,175],{"name":158,"languages":159},"plan-your-cloud",{"nl":160},{"title":161,"url":162},"Plan je cloud","/nl/azure/plan-your-cloud",{"name":164,"languages":165},"migrate-to-the-cloud",{"nl":166},{"title":167,"url":168},"Migreren naar de cloud","/nl/azure/migrate-to-the-cloud",{"name":170,"languages":171},"innovate-your-business",{"nl":172},{"title":173,"url":174},"Vernieuw je business","/nl/azure/innovate-your-business",{"name":176,"languages":177},"vmware-exit",{"nl":178},{"title":179,"url":180},"Herzie je VMware-strategie","/nl/azure/vmware-exit",{"name":182,"languages":183,"children":186},"azure-practices",{"nl":184},{"title":185},"Practices",[187,193,199,202,208,213,219,225],{"name":188,"languages":189},"azure-foundation",{"nl":190},{"title":191,"url":192},"Azure Foundation","/nl/azure/azure-foundation",{"name":194,"languages":195},"azure-ai-foundation",{"nl":196},{"title":197,"url":198},"Azure AI Foundation","/nl/azure/azure-ai-foundation",{"name":86,"languages":200},{"nl":201},{"title":89,"url":90},{"name":203,"languages":204},"azure-data-foundation",{"nl":205},{"title":206,"url":207},"Azure Data Foundation","/nl/azure/azure-data-foundation",{"name":188,"languages":209},{"nl":210},{"title":211,"url":212},"Azure Container Foundation","/nl/azure/azure-container-foundation",{"name":214,"languages":215},"dark-tenant",{"nl":216},{"title":217,"url":218},"Managed Dark Tenant","/nl/azure/managed-dark-tenant",{"name":220,"languages":221},"azure-cloud-adoption-framework",{"nl":222},{"title":223,"url":224},"Cloud Adoption Framework","/nl/azure/cloud-adoption-framework",{"name":226,"languages":227},"azure-cloud-competence-center",{"nl":228},{"title":229,"url":230},"Cloud Competence Center","/nl/azure/cloud-competence-center",{"name":232,"languages":233,"children":242},"security",{"nl":234},{"title":235,"description":236,"emergency":237},"Security","Waakzaam in de cloud met een bekroonde 24/7 managed service, incident response en moderne bescherming van je infrastructuur.",{"text":238,"href":239,"skin":240,"icon":241},"Onder aanval?","/nl/security/are-you-under-attack","primary","emergency",[243,268,289],{"name":244,"children":245},"security-security-consulting",[246,252,256,262],{"name":247,"languages":248},"managed-red-tenant",{"nl":249},{"title":250,"url":251},"Managed Red Tenant","/nl/security/managed-red-tenant",{"name":214,"languages":253},{"nl":254},{"title":255,"url":218},"Dark Tenant",{"name":257,"languages":258},"sentinel-data-lake",{"nl":259},{"title":260,"url":261},"Sentinel Data Lake","/nl/security/sentinel-data-lake",{"name":263,"languages":264},"security-consulting",{"nl":265},{"title":266,"url":267},"Security Consulting","/nl/security/security-consulting",{"name":269,"children":270},"security-cloud-security-operations-center",[271,277,283],{"name":272,"languages":273},"cloud-security-operations-center",{"nl":274},{"title":275,"url":276},"Cloud Security Operations Center","/nl/security/cloud-security-operations-center",{"name":278,"languages":279},"global-secure-access",{"nl":280},{"title":281,"url":282},"Global Secure Access","/nl/security/global-secure-access",{"name":284,"languages":285},"my-work-id",{"nl":286},{"title":287,"url":288},"MyWorkID","/nl/security/my-work-id",{"name":290,"children":291},"security-preventive-services",[292,298,304,310],{"name":293,"languages":294},"preventive-services",{"nl":295},{"title":296,"url":297},"Preventive Services","/nl/security/preventive-services",{"name":299,"languages":300},"data-security-services",{"nl":301},{"title":302,"url":303},"Data Security Service","/nl/security/data-security-service",{"name":305,"languages":306},"security-copilot-agents",{"nl":307},{"title":308,"url":309},"Security Copilot Agents","/nl/security/security-copilot-agents",{"name":311,"languages":312},"nis2",{"nl":313},{"title":314,"url":315},"NIS2 implementeren","/nl/security/red-dark-tenant-nis2",{"name":317,"languages":318,"children":322},"products",{"nl":319},{"title":320,"description":321},"Producten","Companion-producten voor een volledig beveiligde, 100% cloud-native Microsoft-omgeving die samenwerking, netwerkauthenticatie en softwarebeheer versterken.",[323,360],{"name":324,"products":325,"children":326},"lorem ipsum 1",true,[327,336,344,352],{"name":328,"img":329,"target":330,"languages":331},"realmjoin","products/realmjoin/realmjoin-nav-logo.svg","_blank",{"nl":332},{"title":333,"url":334,"subtitle":335},"RealmJoin","https://www.realmjoin.com","Softwaredistributie vanuit de cloud",{"name":337,"img":338,"target":330,"languages":339},"scepman","products/scepman/scepman-nav-logo.svg",{"nl":340},{"title":341,"url":342,"subtitle":343},"SCEPman","https://www.scepman.com","Certificaatdistributie vanuit de cloud",{"name":345,"img":346,"target":330,"languages":347},"konnekt","products/konnekt/konnekt-nav-logo.svg",{"nl":348},{"title":349,"url":350,"subtitle":351},"KONNEKT","https://www.konnekt.io","Werk met je lokale Office 365-data",{"name":353,"img":354,"target":330,"languages":355},"realmigrator","products/realmigrator/realmigrator-nav-logo.svg",{"nl":356},{"title":357,"url":358,"subtitle":359},"RealMigrator","https://www.realmigrator.com","Migreer je data van de ene server naar de andere",{"name":361,"products":325,"children":362},"lorem ipsum 2",[363,371,379,387],{"name":364,"img":365,"target":330,"languages":366},"terraprovider","products/terraprovider/terraprovider-nav-logo.svg",{"nl":367},{"title":368,"url":369,"subtitle":370},"TerraProvider","https://www.terraprovider.com","Terraform Provider voor Microsoft 365",{"name":372,"img":373,"target":330,"languages":374},"radiusaas","products/radius/radius-nav-logo.svg",{"nl":375},{"title":376,"url":377,"subtitle":378},"RADIUSaaS","https://www.radius-as-a-service.com","Authenticatie voor je netwerk",{"name":380,"img":381,"target":330,"languages":382},"unifiedcontacts","products/unified-contacts/unifiedcontact-nav-logo.svg",{"nl":383},{"title":384,"url":385,"subtitle":386},"Unified Contacts","https://www.unified-contacts.com","Contacten vinden in Microsoft Teams",{"name":388,"img":389,"target":330,"languages":390},"autopilotmonitor","products/autopilot-monitor/AutopilotMonitor-nav-logo.svg",{"nl":391},{"title":392,"url":393,"subtitle":394},"Autopilot Monitor","https://www.autopilotmonitor.com","Windows Autopilot-monitoring in realtime",{"name":396,"languages":397},"casestudies",{"nl":398},{"title":399,"url":400,"description":401},"Case studies","/nl/casestudies","Pionier in de cloud: je Microsoft-partner voor doordachte cloudoplossingen met een blueprint-gebaseerde aanpak en expertise in Infrastructure-as-Code.",{"name":403,"languages":404,"children":407},"company",{"nl":405},{"title":406,"description":401},"Bedrijf",[408,438,462],{"name":409,"languages":410,"children":413},"company-about-us",{"nl":411},{"title":412},"Over ons",[414,420,426,432],{"name":415,"languages":416},"company-facts-figures",{"nl":417},{"title":418,"url":419},"Facts & Figures","/nl/company/facts-and-figures",{"name":421,"languages":422},"company-contact",{"nl":423},{"title":424,"url":425},"Contact & locaties","/nl/company/contact-and-locations",{"name":427,"languages":428},"switzerland",{"nl":429},{"title":430,"url":431}," glueckkanja Zwitserland","/nl/company/switzerland",{"name":433,"languages":434},"austria",{"nl":435},{"title":436,"url":437},"glueckkanja Oostenrijk","/nl/company/austria",{"name":439,"languages":440,"children":443},"company-career",{"nl":441},{"title":442},"Carrière",[444,450,456],{"name":445,"languages":446},"company-career-overview",{"nl":447},{"title":448,"url":449},"Carrière-overzicht","/nl/career",{"name":451,"languages":452},"company-young-professionals",{"nl":453},{"title":454,"url":455},"Young Professionals","/nl/young-professionals",{"name":457,"languages":458},"company-jobs",{"nl":459},{"title":460,"url":461},"Vacatures","/nl/job-offers",{"name":463,"languages":464,"children":467},"company-latest",{"nl":465},{"title":466},"Actueel",[468,474],{"name":469,"languages":470},"company-blog",{"nl":471},{"title":472,"url":473},"Blog","/nl/blog",{"name":469,"languages":475},{"nl":476},{"title":477,"url":478},"Events","/nl/events",[480],{"name":481,"languages":482},"career-meta",{"nl":483},{"title":442,"url":449,"active":484},false,{"languages":486},{"nl":487},{"title":488,"url":425,"active":484},"Contact",{"data":490},{"bgColor":491,"number":492,"mail":493,"brandLogos":494,"logos":495,"links":499,"linksNl":509},"var(--color-gk-mid-blue)","+49 69 4005520","info@glueckkanja.com",null,[496],{"img":10,"alt":16,"url":497,"class":498},"index.html","max-w-19rem",[500,503,506],{"title":501,"url":502},"Datenschutz","/de/privacy",{"title":504,"url":505},"Impressum","/de/imprint",{"title":507,"url":508},"No Cookies","/de/cookies",[510,513,516],{"title":511,"url":512},"Privacy","/nl/privacy",{"title":514,"url":515},"Juridische informatie","/nl/imprint",{"title":517,"url":518},"Geen cookies","/nl/cookies",{"id":520,"title":521,"author":522,"body":526,"cta":494,"description":1172,"eventid":494,"extension":1191,"hideInRecent":484,"layout":1192,"meta":1193,"moment":1197,"navigation":325,"path":1261,"seo":1262,"stem":1263,"tags":1264,"webcast":484,"__hash__":1268},"content_nl/posts/2025-01-14-compliant-device-bypass.md","Compliant Device Bypass - alles wat je moet weten",[523,524,525],"Fabian Bader","Christopher Brumm","Thomas Naunheim",{"type":527,"value":528,"toc":1171},"minimal",[529,534,538,592,596,598,611,619,630,636,639,643,645,650,653,656,660,726,729,732,736,738,742,744,759,766,769,772,774,777,780,783,791,802,805,807,810,814,816,819,824,828,830,833,836,839,1002,1006,1008,1011,1051,1055,1057,1064,1067,1070,1085,1088,1091,1145,1153,1157,1159,1162,1165,1168],[530,531,533],"h2",{"id":532},"wat-is-er-tot-nu-toe-gebeurd","Wat is er tot nu toe gebeurd?",[535,536,537],"p",{},"{: .h3-font-size}",[539,540,541,565,580,589],"ul",{},[542,543,544,545,552,553,558,559,564],"li",{},"In december 2024 gaf ",[546,547,551],"a",{"href":548,"rel":549},"https://x.com/TEMP43487580",[550],"nofollow","Yuya Chudo"," zijn talk “",[546,554,557],{"href":555,"rel":556},"https://www.blackhat.com/eu-24/briefings/schedule/#unveiling-the-power-of-intune-leveraging-intune-for-breaking-into-your-cloud-and-on-premise-42176",[550],"Unveiling the Power of Intune: Leveraging Intune for Breaking Into Your Cloud and On-Premise","” op de conferentie Black Hat Europe. In die sessie liet hij zien hoe je een hardcoded en nauwelijks bekende uitzondering in Conditional Access (CA) voor device compliance kunt misbruiken in combinatie met de ongedocumenteerde “",[546,560,563],{"href":561,"rel":562},"https://github.com/secureworks/family-of-client-ids-research",[550],"FOCI-Feature","” in Entra ID. In de talk presenteerde hij ook de reactie van Microsoft MSRC (VULN-123240) dat dit gedrag by design is en nodig is voor een geslaagde Intune Enrollment van nieuwe devices.",[542,566,567,568,573,574,579],{},"Een paar dagen na de conferentie publiceerde Sunny Chau de proof-of-concept-tool ",[546,569,572],{"href":570,"rel":571},"https://github.com/JumpsecLabs/TokenSmith",[550],"TokenSmith",", inclusief een ",[546,575,578],{"href":576,"rel":577},"https://labs.jumpsec.com/tokensmith-bypassing-intune-compliant-device-conditional-access/",[550],"begeleidende blogpost",", waarmee de techniek voor een breder publiek beschikbaar werd.",[542,581,582,583,588],{},"Daarnaast is er een ",[546,584,587],{"href":585,"rel":586},"https://github.com/zh54321/PoCEntraDeviceComplianceBypass/blob/main/poc_entra_compliance_bypass.ps1",[550],"PoC geschreven in PowerShell"," gepubliceerd.",[542,590,591],{},"Sinds eind december onderzoeken wij bij glueckkanja AG hoe deze techniek te voorkomen en te detecteren is. In deze blogpost delen we een deel van onze inzichten over de aanval en bespreken we opties voor mitigatie en detectie.",[530,593,595],{"id":594},"tldr","TL;DR",[535,597,537],{},[535,599,600,601,606,607],{},"Er zijn resources met een ingebouwde uitzondering op bepaalde Grant Controls/Conditions in Conditional Access, bedoeld om specifieke problemen op te lossen. Een daarvan is de uitzondering van de Company Portal App voor Device Compliance, die het kip-en-eiprobleem oplost om devices in Intune te enrollen voordat ze als compliant worden beschouwd. Dit gedrag is ",[546,602,605],{"href":603,"rel":604},"https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-alt-all-users-compliant-hybrid-or-mfa#:~:text=You%20can%20enroll,Company%20Portal%20application",[550],"hier gedocumenteerd",".\n",[608,609,610],"strong",{},"Dit betekent dat je vanaf een unmanaged device een access token en een refresh token voor deze app kunt krijgen, zelfs als een CA-policy Device Compliance voor “All resources” afdwingt.",[535,612,613,618],{},[614,615],"img",{"alt":616,"src":617},"image.png","https://res.cloudinary.com/c4a8/image/upload/blog/pics/company-portal-ca-bypass-02.png","{: .post__screenshot}",[535,620,621,622,626,627],{},"Microsoft heeft een feature geïmplementeerd die Family of Client IDs (FOCI) heet en waarmee een groep Microsoft OAuth-clientapplicaties met hun refresh token access tokens kan opvragen als elke andere client in de family. Gedrag dat in de OAuth2-standaard verder niet is toegestaan. Lees het ",[546,623,625],{"href":561,"rel":624},[550],"originele werk van Secureworks"," voor meer details.\n",[608,628,629],{},"Omdat de Company Portal App een “family member” is, kunnen de daarvoor opgevraagde Refresh Tokens worden gebruikt om tokens voor andere apps in de family te krijgen.",[535,631,632,633],{},"De FOCI-feature is beperkt en de consent tussen de client id en de resource moet expliciet worden geconfigureerd en gegeven. In het geval van de Company Portal App is die consent onder andere gegeven voor toegang tot Microsoft Graph met een beperkte scope en tot de Azure AD Graph API met de permissies van de huidige gebruiker.\n",[608,634,635],{},"Dit betekent dat een Company Portal refresh token gebruikt kan worden om bijvoorbeeld access tokens voor de Azure AD Graph API met de scope user_impersonation te verkrijgen, waarmee we een hoop dingen kunnen doen met bijvoorbeeld AADInternals of ROADrecon",[535,637,638],{},"Om de aanval uit te voeren heeft de aanvaller óf geldige credentials van het slachtoffer plus de mogelijkheid om MFA uit te voeren als Conditional Access dat vereist, óf een geldig refresh token nodig.",[530,640,642],{"id":641},"welk-risico-en-welke-blast-radius-bestaan-er","Welk risico en welke blast radius bestaan er?",[535,644,537],{},[646,647,649],"h3",{"id":648},"welke-van-de-mogelijke-resources-scopes-worden-geraakt-door-de-compliance-uitzondering","Welke van de mogelijke resources (scopes) worden geraakt door de compliance-uitzondering?",[535,651,652],{},"{: .h4-font-size}",[535,654,655],{},"De aanvaller heeft de mogelijkheid om tokens voor een andere FOCI-applicatie op te vragen, zoals hiervoor al beschreven. Microsoft heeft de bypass voor de device compliance-vereisten echter alleen geïmplementeerd voor het opvragen van tokens naar bepaalde resource-applicaties met verschillende API-permission scopes. Met name de volgende delegated API-permissies zijn gevoelig en interessant voor aanvallers:",[657,658,659],"style",{},"\ntable {\n  font-family: arial, sans-serif;\n  border-collapse: collapse;\n  width: 100%;\n}\n\ntd, th {\n  border: 1px solid #dddddd;\n  text-align: left;\n  padding: 8px;\n}\n\ntr:nth-child(even) {\n  background-color: #dddddd;\n}\n",[661,662,663,679],"table",{},[664,665,666],"thead",{},[667,668,669,673,676],"tr",{},[670,671,672],"th",{},"Resource Application",[670,674,675],{},"Application Id",[670,677,678],{},"Delegated Permission Scope",[680,681,682,694,705,716],"tbody",{},[667,683,684,688,691],{},[685,686,687],"td",{},"AADGraph",[685,689,690],{},"00000002-0000-0000-c000-000000000000",[685,692,693],{},"user_impersonation",[667,695,696,699,702],{},[685,697,698],{},"Microsoft Graph API",[685,700,701],{},"00000003-0000-0000-c000-000000000000",[685,703,704],{},"“email\", \"openid\", \"profile\",\"Device.Read.All\", \"DeviceManagementConfiguration.Read.All\", \"DeviceManagementConfiguration.ReadWrite.All\", \"ServicePrincipalEndpoint.Read.All\", \"User.Read”",[667,706,707,710,713],{},[685,708,709],{},"Device Registration Service",[685,711,712],{},"01cb2876-7ebd-4aa4-9cc9-d28bd4d359a9",[685,714,715],{},"adrs_access",[667,717,718,721,724],{},[685,719,720],{},"Windows Azure Service Management API",[685,722,723],{},"797f4846-ba00-4fd7-ba43-dac1f8f63013",[685,725,693],{},[535,727,728],{},"Omdat de gegeven permissies niet voor de applicatie zelf gelden, hangt de impact af van de privileges van de aanroeper (het gebruikersaccount) en van welke delegated permission scopes gemachtigd zijn om API-calls op die scope uit te voeren.",[535,730,731],{},"Laten we de kritikaliteit van de genoemde delegated permission scopes en de mogelijke autorisatie om gevoelige API's aan te roepen nader bekijken.",[530,733,735],{"id":734},"welke-privileges-en-delegated-scope-zijn-kritiek","Welke privileges en delegated scope zijn kritiek?",[535,737,537],{},[646,739,741],{"id":740},"azure-ad-graph-api","Azure AD Graph API",[535,743,652],{},[535,745,746,747,752,753,758],{},"De legacy programmeerinterface biedt veel API's om directory-instellingen en objecten in Entra ID (Azure AD) te beheren. Daaronder vallen Conditional Access-policies, directory roles, CRUD op groepen en devices en operaties op de aangemelde gebruiker, zoals het wijzigen van het wachtwoord. Een volledige lijst van alle ondersteunde operaties staat in de ",[546,748,751],{"href":749,"rel":750},"https://learn.microsoft.com/en-us/previous-versions/azure/ad/graph/api/api-catalog",[550],"Azure AD Graph API reference",". Deze API wordt op 30 juni 2025 volledig uitgefaseerd (op basis van ",[546,754,757],{"href":755,"rel":756},"https://learn.microsoft.com/en-us/graph/migrate-azure-ad-graph-overview",[550],"de recentste aankondigingen van Microsoft",").",[535,760,761,762,765],{},"De toegewezen delegated scope “user_impersonation” staat de applicatie (in dit geval Company Portal) toe om namens de gebruiker te handelen. Elke permissie die de aangemelde gebruiker op een Entra-object, een scope of op directory-niveau heeft, kan dus als autorisatie in de API-calls worden gebruikt. De gebruiker kan owner zijn van een Entra ID-object (applicatie, groep of ander object), of permissies hebben via Entra ID role assignments. ",[608,763,764],{},"Bij actieve high privileged role assignments zou dit de aanvaller in staat stellen objecten te wijzigen of de tenant te compromitteren",". En zelfs zonder enige privileges kunnen op zijn minst de default user permissions worden gebruikt voor uitgebreide reconnaissance en enumeratie van directory-objecten in de tenant.",[535,767,768],{},"De scenario's en de impact van misbruik van de Azure AD Graph API hangen daarom af van de actieve of permanent toegewezen privileges van de betrokken gebruiker. API's voor toegang tot Microsoft 365-services (bijvoorbeeld voor exfiltratie van OneDrive) zitten niet in Azure AD Graph.",[646,770,698],{"id":771},"microsoft-graph-api",[535,773,652],{},[535,775,776],{},"Vergeleken met Azure AD Graph is de delegated scope voor de Microsoft Graph API beperkt tot een bepaalde scope. Naast de OpenID-scopes (openid, email, profile) en basale leesoperaties namens de gebruiker (ServicePrincipalEndpoint.Read.All, User.Read).",[535,778,779],{},"Alle device-objecten kunnen worden opgesomd en gelezen door met default permissions het “device”-endpoint in Microsoft Graph aan te roepen via “Device.Read.All”. Dat kan aanvallers helpen om inzicht te krijgen in device-objecten.",[535,781,782],{},"Bij een gecompromitteerde gebruiker met de rol “Intune Administrator” of met een delegatie in Microsoft Intune RBAC moeten de volgende gegeven delegated API-permissies als problematisch worden beschouwd:",[539,784,785,788],{},[542,786,787],{},"“DeviceManagementConfiguration.Read.All”",[542,789,790],{},"“DeviceManagementConfiguration.ReadWrite.All”",[535,792,793],{},[608,794,795,796,801],{},"Deze delegated permissies maken CRUD-operaties mogelijk, bijvoorbeeld op Device Compliance- en Configuration-policies, maar ook het uitrollen van ",[546,797,800],{"href":798,"rel":799},"https://learn.microsoft.com/en-us/graph/api/intune-shared-devicemanagementscript-create?view=graph-rest-beta",[550],"Management Scripts"," voor verdere kwaadaardige activiteit op de doeldevices.",[646,803,709],{"id":804},"device-registration-service",[535,806,652],{},[535,808,809],{},"Met deze permissie kan de aanvaller een device joinen of registreren in Entra ID. Daarmee kan hij het device zelfs in Intune enrollen en, afhankelijk van de Intune-configuratie, een geldig en compliant device krijgen om nog meer beschermde services te benaderen.",[646,811,813],{"id":812},"andere-foci-applicaties","Andere FOCI-applicaties",[535,815,652],{},[535,817,818],{},"Toegang vragen tot andere privileged interfaces, bijvoorbeeld de Azure Resource Manager API, valt binnen de scope van FOCI en is voor de aanvaller ook interessant. Die resource is echter nog steeds beschermd en wordt niet gebypassed voor de Conditional Access grant control “compliant device”.",[535,820,821],{},[614,822],{"alt":616,"src":823},"https://res.cloudinary.com/c4a8/image/upload/blog/pics/company-portal-ca-bypass-03.png",[530,825,827],{"id":826},"kunnen-we-deze-aanvalstechniek-detecteren","Kunnen we deze aanvalstechniek detecteren?",[535,829,537],{},[535,831,832],{},"Zoals hierboven beschreven zit het grootste risico in toegang tot MS Graph en Azure AD Graph.",[535,834,835],{},"Omdat in dit geval altijd de application ID van de Microsoft Intune Company Portal App wordt gebruikt, is de belangrijkste taak bij het bouwen van een detectie het uitsluiten van legitiem gebruik, bijvoorbeeld door device-registraties. Volgens onze observatie zit het onderscheid in de vraag welke resources als eerste in een sessie worden benaderd → bij een aanval doorgaans MS Graph of Azure AD Graph.",[535,837,838],{},"Hier is een werkende detectie die we in verschillende omgevingen van uiteenlopende grootte hebben getest:",[840,841,843,844,847,848,853,854,858,862,865,866,868,865,872,847,874,876,877,865,881,883,865,886,847,888,890,891,893,865,896,847,898,900,901,904,905,908,909,912,913,847,915,918,919,921,865,924,847,926,904,929,931,932,934,935,937,938,865,941,934,943,946,947,950,951,953,954,918,957,959,865,962,847,964,966,967,847,969,971,972,865,975,977,865,979,847,981,876,983,865,985,987,865,990,847,992,900,994,904,996,908,998,912,1000],"div",{"style":842},"background-color:#000000; font-family: 'Source Code Pro', 'Courier New', monospace; padding: 15px; color: #ffffff","\nAADSignInEventsBeta ",[845,846],"br",{},"\n| ",[849,850,852],"span",{"style":851},"color: #569CD6;","where"," Timestamp > ",[849,855,857],{"style":856},"color: #E6DB74;","ago(",[849,859,861],{"style":860},"color: #A6E22E;","7d",[849,863,864],{"style":856},")"," ",[845,867],{},[849,869,871],{"style":870},"color: #75715E;","// Access to Microsoft Intune Company Portal",[845,873],{},[849,875,852],{"style":851}," ApplicationId == ",[849,878,880],{"style":879},"color: #D69D85;","@\"9ba1a5c7-f17a-4de9-a1f1-6178c8d51223\"",[845,882],{},[849,884,885],{"style":870},"// From non joined/registered device",[845,887],{},[849,889,852],{"style":851}," isempty(AadDeviceId) ",[845,892],{},[849,894,895],{"style":870},"// Used to access resource Microsoft Graph or Windows Azure Active Directory",[845,897],{},[849,899,852],{"style":851}," ResourceId ",[849,902,903],{"style":851},"in"," (",[849,906,907],{"style":879},"\"00000002-0000-0000-c000-000000000000\"",", ",[849,910,911],{"style":879},"\"00000003-0000-0000-c000-000000000000\"",") ",[845,914],{},[849,916,917],{"style":851},"summarize by"," SessionId ",[845,920],{},[849,922,923],{"style":870},"// Find the initial logon event based on the session Id",[845,925],{},[849,927,928],{"style":851},"join kind=inner",[845,930],{},"\n    AADSignInEventsBeta ",[845,933],{},"\n    | ",[849,936,852],{"style":851}," ErrorCode == ",[849,939,940],{"style":860},"0",[845,942],{},[849,944,945],{"style":851},"summarize arg_min(","Timestamp, *",[849,948,949],{"style":851},") by"," SessionId)",[845,952],{},"\n    ",[849,955,956],{"style":851},"on",[845,958],{},[849,960,961],{"style":870},"// Ignore trusted and managed devices",[845,963],{},[849,965,852],{"style":851}," isempty(DeviceTrustType) ",[845,968],{},[849,970,852],{"style":851}," IsManaged != ",[849,973,974],{"style":860},"1",[845,976],{},[849,978,871],{"style":870},[845,980],{},[849,982,852],{"style":851},[849,984,880],{"style":879},[845,986],{},[849,988,989],{"style":870},"// when the first requested resource is Microsoft Graph or Windows Azure Active Directory",[845,991],{},[849,993,852],{"style":851},[849,995,903],{"style":851},[849,997,907],{"style":879},[849,999,911],{"style":879},[845,1001],{},[530,1003,1005],{"id":1004},"hoe-reageren-we-als-we-verdachte-activiteit-detecteren","Hoe reageren we als we verdachte activiteit detecteren?",[535,1007,537],{},[535,1009,1010],{},"Start je incident response-proces met een gedefinieerd playbook dat het volgende bevat:",[539,1012,1013,1034,1042,1045,1048],{},[542,1014,1015,1016],{},"Hunten naar verdachte of afwijkende activiteit van de gecompromitteerde gebruiker\n",[539,1017,1018,1025,1028,1031],{},[542,1019,1020,1021],{},"Overzicht van non-interactive sign-ins naar resource-applicaties, inclusief IP-adressen en UserAgents op basis van ",[1022,1023,1024],"code",{},"sessionId",[542,1026,1027],{},"Controleren of de Microsoft Entra Audit Logs kritieke operaties door de gebruiker of vanaf de IP-adressen tonen (bijvoorbeeld toegevoegde credentials bij app-registraties waarvan de gebruiker owner is)",[542,1029,1030],{},"Vaststellen of de gebruiker in de betrokken sessie devices heeft geregistreerd",[542,1032,1033],{},"De Intune-auditlogs controleren op operaties door de applicatie “Company Portal” en door de betrokken gebruiker",[542,1035,1036,1037],{},"Hunten naar gerelateerde alerts van de betrokken entiteiten\n",[539,1038,1039],{},[542,1040,1041],{},"Entiteiten opzoeken in de tabel AlertEvidence om andere alerts te vinden op basis van SessionId, IP-adressen en gebruiker",[542,1043,1044],{},"De kritikaliteit van de gebruiker (op basis van privileges) bepalen in Exposure Management",[542,1046,1047],{},"De hunting-resultaten reviewen en verifiëren of de actie legitiem was als onderdeel van een device enrollment.",[542,1049,1050],{},"De initiële toegangsvector identificeren en de credentials van de gebruiker resetten, en waar nodig ook devices.",[530,1052,1054],{"id":1053},"kunnen-we-de-aanval-mitigeren","Kunnen we de aanval mitigeren?",[535,1056,537],{},[535,1058,1059,1060,1063],{},"Omdat de geconfigureerde uitzondering nodig is voor Intune enrollment, ",[608,1061,1062],{},"is er geen mitigatie die niet andere delen van Microsoft 365 kapotmaakt",". Toegang tot de resource Azure AD Graph kan niet direct worden gescoped of geblokkeerd. Elke Conditional Access-policy die “Block” als grant control gebruikt, voorkomt toegang, maar kan andere consequenties hebben.",[535,1065,1066],{},"Voor mitigatie is het belangrijk te begrijpen dat deze Conditional Access-bypass geen volledige aanval is. Het is een techniek die als tussenstap een reeks aanvallen mogelijk maakt.",[535,1068,1069],{},"Een aanvalspad kan zijn",[1071,1072,1073,1076,1079,1082],"ol",{},[542,1074,1075],{},"Account compromise via phishing en AiTM",[542,1077,1078],{},"Conditional Access-bypass",[542,1080,1081],{},"Reconnaissance met bijvoorbeeld ROADrecon, GraphRunner of AADInternals",[542,1083,1084],{},"Lateral movement, privilege escalation of persistence via een nieuw geregistreerd device dat in Intune is geënrolleerd",[535,1086,1087],{},"Omdat we de Conditional Access-bypass niet kunnen mitigeren zonder Intune enrollment te breken, is het meer dan verstandig om mitigaties bij de andere stappen van het aanvalspad in te bouwen en daarnaast zinvolle detecties te implementeren.",[535,1089,1090],{},"Om de waarschijnlijkheid en de impact te verkleinen raden we aan om andere controls te versterken en het volgende op korte termijn te implementeren:",[539,1092,1093,1099,1105,1111,1117,1133,1139],{},[542,1094,1095,1098],{},[608,1096,1097],{},"Dwing MFA af voor “All Users” en “All Cloud Apps” via Conditional Access."," Als je alleen Device Compliance afdwingt, is single factor authentication met deze techniek al voldoende.",[542,1100,1101,1104],{},[608,1102,1103],{},"Gebruik Device Compliance of MFA niet als alternatieven in je rulesets, dwing altijd beide af."," Met OR beperk je toegang nooit volledig tot compliant devices, omdat een access token met MFA in scope al genoeg is om de tenant te benaderen.",[542,1106,1107,1110],{},[608,1108,1109],{},"Beperk Security Information Registration tot compliant devices, phishing-resistant authenticatie of TAP."," In onze tests lukte het ons niet om Device Compliance voor de Security Info Registration te bypassen.",[542,1112,1113,1116],{},[608,1114,1115],{},"Vereis phishing-resistant authenticatie of TAP voor Join or Register Devices."," Zonder die eis is het mogelijk om met bijvoorbeeld AADInternals en deze techniek een device te registreren.",[542,1118,1119,1122,1123],{},[608,1120,1121],{},"Vereis MFA en “Sign-in frequency every time” voor Microsoft Intune Enrollment."," Dat beperkt de periode waarin een aanvaller verse credentials kan gebruiken om een nieuw device in Intune te enrollen.\n",[1124,1125,1126],"blockquote",{},[535,1127,1128,1129,1132],{},"🚧\n",[608,1130,1131],{},"Let op: Sign-in frequency every time = elke vijf minuten","\nMicrosoft rekent met vijf minuten clock skew wanneer “every time” in een Conditional Access-policy is geselecteerd, zodat gebruikers niet vaker dan één keer per vijf minuten een prompt krijgen.",[542,1134,1135,1138],{},[608,1136,1137],{},"Blokkeer personally owned devices in de Intune Enrollment restrictions."," Zonder die restricties kan een aanvaller een nieuw device enrollen en extra voet aan de grond krijgen.",[542,1140,1141,1144],{},[608,1142,1143],{},"Zet device compliance op fail wanneer er in Intune geen compliance policy aan een device is toegewezen."," Standaard wordt elk device als compliant beschouwd, ook als er feitelijk geen policy is toegepast. Verander dat en maak een device compliance policy verplicht.",[535,1146,1147,1148,1152],{},"Op langere termijn moedigen we je aan te investeren in de uitrol van wachtwoordloze, phishing-resistant authenticatie zoals Windows Hello for Business en passkeys (inclusief Platform Credentials via macOS Platform SSO). Daarmee kun je vervolgens phishing-resistant authenticatie afdwingen en AiTM-aanvallen blokkeren. Sta in plaats van een wachtwoord het gebruik van een Temporary Access Pass (TAP) toe voor beperkte tijd en beperkte scenario's, bijvoorbeeld het onboarden van nieuwe devices of medewerkers. Om het gebruik van TAP's voor verschillende use cases te ondersteunen hebben we ",[546,1149,287],{"href":1150,"rel":1151},"https://myworkid.cloud/",[550]," gebouwd.",[530,1154,1156],{"id":1155},"conclusie","Conclusie",[535,1158,537],{},[535,1160,1161],{},"Conditional Access als Zero Trust-engine voor Entra ID is op zichzelf al ingewikkeld. Door Microsoft ingebouwde uitzonderingen in de backend van Entra maken het voor veel mensen nog moeilijker om de impact van policies en beschermingsmaatregelen te doorzien. Toch houdt het idee van Zero Trust en defense in depth stand.",[535,1163,1164],{},"De device compliance-policy voorkomt de meeste AiTM-aanvallen en multi-factor authentication maakt het voor een aanvaller moeilijker om gelekte of anderszins gecompromitteerde credentials te misbruiken.",[535,1166,1167],{},"Al deze securitymaatregelen moeten samen worden gebruikt en niet als vervanging van elkaar. Zo blijft de omgeving veilig, ook als een van de verdedigingslagen wordt gemanipuleerd of doorbroken.",[535,1169,1170],{},"We raden sterk aan om de geleverde detectie in Microsoft Defender XDR uit te rollen, zodat mogelijk misbruik daadwerkelijk wordt opgemerkt. Zorg ervoor dat je SOC voorbereid is om dit soort incidenten te onderzoeken en geef het team de nodige playbooks.",{"title":1172,"searchDepth":1173,"depth":1173,"links":1174},"",2,[1175,1176,1177,1181,1187,1188,1189,1190],{"id":532,"depth":1173,"text":533},{"id":594,"depth":1173,"text":595},{"id":641,"depth":1173,"text":642,"children":1178},[1179],{"id":648,"depth":1180,"text":649},3,{"id":734,"depth":1173,"text":735,"children":1182},[1183,1184,1185,1186],{"id":740,"depth":1180,"text":741},{"id":771,"depth":1180,"text":698},{"id":804,"depth":1180,"text":709},{"id":812,"depth":1180,"text":813},{"id":826,"depth":1173,"text":827},{"id":1004,"depth":1173,"text":1005},{"id":1053,"depth":1173,"text":1054},{"id":1155,"depth":1173,"text":1156},"md","post",{"lang":1194,"seoTitle":1195,"titleClass":1196,"date":1197,"categories":1198,"blogtitlepic":1199,"socialimg":1200,"customExcerpt":1201,"keywords":1202,"contactInContent":1203,"scripts":1260},"nl","Compliant Device Bypass in Microsoft Intune – detectie, response en mitigatie","h2-font-size","2025-01-14",[235],"header-company-portal-ca-bypass","/blog/heads/header-company-portal-ca-bypass.png","In deze blogpost verzamelen Fabian Bader (MVP bij glueckkanja), Chris Brumm en Thomas Naunheim de details over de Compliant Device Bypass in de Microsoft Intune Company Portal. Na aanvullend onderzoek hebben ze een aanpak gevonden om de potentiële dreiging te detecteren en erop te reageren. Je vindt hier ook guidance over Conditional Access om het aanvalsoppervlak te verkleinen en details over de blast radius.","Compliant Device Bypass, Microsoft Intune, Conditional Access, Entra ID, Intune Company Portal, device compliance, CA exclusion, TokenSmith PoC, cloud security, PowerShell PoC, Fabian Bader, Christopher Brumm, Thomas Naunheim, security threat, Black Hat Europe, Intune Enrollment, MSRC response, attack detection, threat mitigation, cloud compliance, FOCI feature",{"quote":484,"infos":1204},{"bgColor":1205,"color":1206,"boxBgColor":1207,"boxColor":1208,"headline":1209,"subline":1210,"level":530,"textStyling":1211,"flush":1212,"person":1213,"form":1225},"var(--color-gk-violet)","var(--color-gk-white)","var(--color-gk-yellow)","var(--color-copy)","Neem nu contact op","Wil je meer weten over de Compliant Device Bypass en over hoe je die effectief detecteert en mitigeert? Onze experts nemen onze bevindingen met je door en ondersteunen je met bewezen strategieën voor betere security. We kijken ernaar uit om met je in contact te komen.","text-light","justify-content-end",{"image":1214,"cloudinary":325,"alt":1215,"name":1215,"detailsHeader":1216,"details":1217},"/people/people-pam-team.png","Project & Account Management","We horen graag van je.",[1218,1222],{"text":492,"href":1219,"details":1220,"icon":1221},"tel:+49 69 4005520","Nu bellen","site/phone",{"text":493,"href":1223,"icon":1224},"mailto:info@glueckkanja.com","site/mail",{"ctaText":1226,"cta":1227,"method":1192,"action":1229,"fields":1230},"Versturen",{"skin":1228},"primary on-surface","/send",[1231,1235,1240,1243,1247,1252,1255,1258],{"type":1232,"id":1233,"value":1234},"hidden","_next","successful",{"label":1236,"type":1237,"id":1238,"required":325,"requiredMsg":1239},"Naam*","text","name","Vul je naam in.",{"label":1241,"type":1237,"id":403,"required":325,"requiredMsg":1242},"Bedrijf*","Vul je bedrijf in.",{"label":1244,"type":1245,"id":1245,"required":325,"requiredMsg":1246},"E-mailadres*","email","Vul je e-mailadres in.",{"label":1248,"type":1249,"id":1250,"required":325,"requiredMsg":1251},"Je gegevens worden bij ons opgeslagen om je aanvraag te verwerken en erop te reageren. Meer informatie over gegevensbescherming vind je in onze \u003Ca href=\"/nl/privacy\">privacyverklaring\u003C/a>.","checkbox","dataprotection","Bevestig dit",{"type":1232,"id":1253,"value":1254},"_subject","Request Global Secure Access",{"type":1232,"id":1256,"value":1257},"inbox_key","gkgab-contact-form",{"type":1232,"id":1259},"_gotcha",{"slick":325,"form":325},"/posts/2025-01-14-compliant-device-bypass",{"title":521,"description":1172},"posts/2025-01-14-compliant-device-bypass",[235,1265,1266,1267,281],"Entra","Conditional Access","ITDR","btJVpbhV97E39Nf1HNmrfou1fgCiYSr3kEgN5RQGETk",{"id":1270,"extension":1271,"meta":1272,"stem":8,"__hash__":1619},"authors_data/authors.json","json",{"path":1273,"Fritz Zurhorst":1274,"Alexander Schlindwein":1280,"Sophie Luna":1286,"Nadine Klein":1294,"Karsten Kleinschmidt":1300,"Julian Wendt":1308,"Holger Bunkradt":1313,"Ralf Mania":1319,"Oliver Kieselbach":1325,"Steffen Schwerdtfeger":1331,"Gunnar Winter":1339,"Jan Petersen":1344,"Thorsten Kunzi":1349,"Moritz Pohl":1353,"Thorben Pöschus":1358,"Christoph Hannebauer":1364,"Marco Scheel":1368,"Christopher Brumm":1373,"Florian Klante":1379,"Niklas Bachmann":1384,"Nils Krautkrämer":1389,"Patrick Treptau":1395,"Peter Beckendorf":1400,"Patrick Sobau":1405,"Jörg Wunderlich":1410,"Michael Breither":1414,"Christian Kanja":1419,"Zeba Hoffmann":1425,"Jochen Fröhlich":1430,"Jan Geisbauer":1434,"Gerrit Reinke":1445,"Christian Kordel":1451,"Stephan Wälde":1455,"Carolin Kanja":1460,"Adrian Ritter":1466,"Marvin Bangert":1471,"Thorsten Pickhan":1477,"Christian Lorenz":1483,"Denis Böhm":1488,"Fabian Bader":1493,"Juan Jose Fernandez Perez":1498,"Mahschid Sayyar":1503,"Benjamin Dassow":1508,"Markus Walschburger":1513,"Jonathan Haist":1518,"Daniel Rohregger":1523,"Thomas Naunheim":1528,"Florian Stöckl":1532,"Pascal Asch":1537,"Markus Kättner":1542,"Anna Ulbricht":1549,"Annette Brauns":1556,"body":1562,"title":1618},"/authors",{"display_name":1275,"avatar":1276,"permalink":1277,"linkedin":1278,"imageOffsetTop":1279},"Fritz Zurhorst","people/people-fritz-zurhorst.png","/authors/fritz-zurhorst","friedemann-z","72%",{"display_name":1281,"avatar":1282,"permalink":1283,"twitter":1284,"linkedin":1285},"Alexander Schlindwein","people/people-alexander-rudolph.png","/authors/alexander-schlindwein","AlexanderOnIT","schlindwein-alexander",{"display_name":1287,"avatar":1288,"permalink":1289,"twitter":1290,"linkedin":1291,"imageOffsetLeft":1292,"imageOffsetTop":1293},"Sophie Luna","people/people-sophie-luna.jpg","/authors/sophie-luna","glueckkanjagab","../company/glueckkanja-gab","58%","67%",{"display_name":1295,"avatar":1296,"permalink":1297,"twitter":1298,"linkedin":1299,"imageOffsetTop":1279},"Nadine Klein","people/people-nadine-kern.png","/authors/nadine-kern","nadineausRT","nadine-kern",{"display_name":1301,"avatar":1302,"permalink":1303,"twitter":1304,"linkedin":1305,"imageOffsetTop":1306,"imageOffsetLeft":1307},"Karsten Kleinschmidt","/c_pad,w_800,h_700/people/karsten-kleinschmidt.jpg","/authors/karsten-kleinschmidt","KarstenonIT","karstenkleinschmidt","60%","57%",{"display_name":1309,"avatar":1310,"permalink":1311,"linkedin":1312},"Julian Wendt","people/people-julian-wendt.png","/authors/julian-wendt","julian-wendt",{"display_name":1314,"avatar":1315,"permalink":1316,"linkedin":1317,"twitter":1318},"Holger Bunkradt","people/people-holger-bunkradt.png","/authors/holger-bunkradt","holger-bunkradt-12b5053b","hbunkradt",{"display_name":1320,"avatar":1321,"permalink":1322,"linkedin":1323,"twitter":1324},"Ralf Mania","people/people-ralf-mania.png","/authors/ralf-mania","ralf-mania-146a2757","RaMa1976",{"display_name":1326,"avatar":1327,"permalink":1328,"linkedin":1329,"twitter":1330},"Oliver Kieselbach","people/people-oliver-kieselbach.png","/authors/oliver-kieselbach","oliver-kieselbach-a4a3409","okieselbT",{"display_name":1332,"avatar":1333,"permalink":1334,"linkedin":1335,"twitter":1336,"imageOffsetTop":1337,"imageOffsetLeft":1338},"Steffen Schwerdtfeger","people/people-steffen-schwerdtfeger.png","/authors/steffen-schwerdtfeger","steffen-schwerdtfeger","SteffenAtCloud","79%","51%",{"display_name":1340,"avatar":1341,"permalink":1342,"twitter":1290,"linkedin":1343},"Gunnar Winter","people/people-gunnar-winter.jpg","/authors/gunnar-winter","company/glueckkanja-gab",{"display_name":1345,"avatar":1346,"permalink":1347,"twitter":1290,"linkedin":1348},"Jan Petersen","people/jan-petersen.png","/authors/jan-petersen","jan-petersen-26a901",{"display_name":1350,"avatar":1351,"permalink":1352,"twitter":1290,"linkedin":1343,"imageOffsetTop":1279},"Thorsten Kunzi","people/author-thorsten-kunzi.png","/authors/thorsten-kunzi",{"display_name":1354,"avatar":1355,"permalink":1356,"twitter":1290,"linkedin":1357},"Dr. Moritz Pohl","people/people-moritz-pohl.png","/authors/moritz-pohl","dr-moritz-pohl",{"display_name":1359,"avatar":1360,"permalink":1361,"twitter":1362,"linkedin":1363},"Thorben Pöschus","people/thorben.poeschus.png","/authors/thorben-poeschus","TPO901","thorben-pöschus-624693b7",{"display_name":1365,"avatar":1366,"permalink":1367,"twitter":1290,"linkedin":1343,"imageOffsetTop":1279},"Dr. Christoph Hannebauer","people/people-christoph-hannebauer.png","/authors/christoph-hannebauer",{"display_name":1369,"avatar":1370,"permalink":1371,"twitter":1372,"linkedin":1372},"Marco Scheel","people/people-marco-scheel.png","/authors/marco-scheel","marcoscheel",{"display_name":524,"avatar":1374,"permalink":1375,"twitter":1376,"linkedin":1377,"imageOffsetTop":1378},"people/people-christopher-brumm.jpg","/authors/christopher-brumm","cbrhh","christopherbrumm","66%",{"display_name":1380,"avatar":1381,"permalink":1382,"linkedin":1383,"twitter":1290},"Florian Klante","people/florian-klante.jpg","/authors/florian-klante","florian-klante-6031b31b",{"display_name":1385,"avatar":1386,"permalink":1387,"linkedin":1388,"twitter":1290},"Niklas Bachmann","people/niklas.bachmann.png","/authors/niklas-bachmann","niklas-bachmann-66a863158",{"display_name":1390,"avatar":1391,"permalink":1392,"twitter":1393,"linkedin":1394},"Nils Krautkrämer","people/nils-krautkraemer.png","/authors/nils-krautkraemer","KrauNils","nils-krautkrämer-8b04bb250",{"display_name":1396,"avatar":1397,"permalink":1398,"linkedin":1399,"twitter":1290},"Patrick Treptau","people/people-patrick-treptau.png","/authors/patrick-traptau","ptreptau",{"display_name":1401,"avatar":1402,"permalink":1403,"linkedin":1404,"twitter":1290,"imageOffsetTop":1279},"Peter Beckendorf","people/peter-beckendorf.png","/authors/peter-beckendorf","peter-beckendorf-29a239b1",{"display_name":1406,"avatar":1407,"permalink":1408,"linkedin":1409,"twitter":1290},"Patrick Sobau","people/patrick-sobau.png","/authors/patrick-sobau","patrick-sobau",{"display_name":1411,"avatar":1412,"permalink":1413,"twitter":1290},"Jörg Wunderlich","people/joerg-wunderlich.png","/authors/joerg-wunderlich",{"display_name":1415,"avatar":1416,"permalink":1417,"twitter":1290,"linkedin":1418},"Michael Breither","people/people-michael-breither.jpg","/authors/michael-breither","michaelbreither",{"display_name":1420,"avatar":1421,"permalink":1422,"twitter":1423,"linkedin":1424},"Christian Kanja","people/people-christian-kanja.png","/authors/christian-kanja","cekageka","christian-kanja",{"display_name":1426,"avatar":1427,"permalink":1428,"linkedin":1429,"twitter":1290},"Zeba Hoffmann","people/zeba-hoffmann.png","/authors/zeba-hoffmann","zebahoffmann",{"display_name":1431,"avatar":1432,"permalink":1433,"twitter":1290,"linkedin":1343},"Jochen Fröhlich","people/people-jochen-froehlich.png","/authors/jochen-froehlich",{"display_name":1435,"avatar":1436,"permalink":1437,"twitter":1438,"linkedin":1438,"imageOffsetTop":1279,"socials":1439},"Jan Geisbauer","people/people-jan-geisbauer-csoc.png","/authors/jan-geisbauer","JanGeisbauer",[1440,1442],{"text":472,"href":1441},"https://emptydc.com",{"text":1443,"href":1444},"Podcast","https://hairlessinthecloud.com",{"display_name":1446,"avatar":1447,"permalink":1448,"twitter":1449,"linkedin":1450},"Gerrit Reinke","people/gerrit-reinke.png","/authors/gerrit-reinke","GLWRe","glwr",{"display_name":1452,"avatar":1453,"permalink":1454,"twitter":1290,"linkedin":1343},"Christian Kordel","people/christian-kordel.png","/authors/christian-kordel",{"display_name":1456,"avatar":1457,"permalink":1458,"twitter":1459,"linkedin":1343},"Stephan Wälde","people/people-stephan-waelde.png","/authors/stephan-waelde","stephanwaelde",{"display_name":1461,"avatar":1462,"permalink":1463,"twitter":1464,"linkedin":1465},"Carolin Kanja","people/people-carolin-kanja.jpg","/authors/carolin-kanja","fraukanja","carolin-kanja",{"display_name":1467,"avatar":1468,"permalink":1469,"twitter":1470,"linkedin":1470},"Adrian Ritter","people/people-adrian-ritter.png","/authors/adrian-ritter","adrianritter",{"display_name":1472,"avatar":1473,"permalink":1474,"twitter":1475,"linkedin":1476},"Marvin Bangert","people/people-marvin-bangert.png","/authors/marvin-bangert","marvinbangert","marvin-bangert",{"display_name":1478,"avatar":1479,"permalink":1480,"twitter":1481,"linkedin":1482},"Thorsten Pickhan","people/people-thorsten-pickhan.png","/authors/thorsten-pickhan","tpickhan","thorsten-pickhan",{"display_name":1484,"avatar":1485,"permalink":1486,"linkedin":1487,"twitter":1290},"Christian Lorenz","people/people-christian-lorenz.png","/authors/christian-lorenz","christianlorenz95",{"display_name":1489,"avatar":1490,"permalink":1491,"linkedin":1492,"twitter":1290},"Denis Böhm","people/people-denis-boehm.png","/authors/denis-boehm","denis-böhm-3bb834135",{"display_name":523,"avatar":1494,"permalink":1495,"linkedin":1496,"twitter":1497},"people/people-fabian-bader.jpg","/authors/fabian-bader","fabianbader","fabian_bader",{"display_name":1499,"avatar":1500,"permalink":1501,"linkedin":1502},"Juan Jose Fernandez Perez","people/people-juan-jose-fernandez.jpg","/authors/juan-jose-fernandez-perez","juan-jose-fernandez-perez-8016055",{"display_name":1504,"avatar":1505,"permalink":1506,"linkedin":1507},"Mahschid Sayyar","people/people-mahschid-sayyar.jpg","/authors/mahschid-sayyar","mahschid-sayyar-97544463",{"display_name":1509,"avatar":1510,"permalink":1511,"linkedin":1512},"Benjamin Dassow","people/people-benjamin-dassow.jpg","/authors/benjamin-dassow","benjamin-dassow",{"display_name":1514,"avatar":1515,"permalink":1516,"linkedin":1517},"Markus Walschburger","people/people-markus-walschburger.jpg","/authors/markus-walschburger","markus-walschburger",{"display_name":1519,"avatar":1520,"permalink":1521,"linkedin":1522,"imageOffsetTop":1279},"Jonathan Haist","people/people-jonathan-haist.jpg","/authors/jonathan-haist","jonathanhaist",{"display_name":1524,"avatar":1525,"permalink":1526,"linkedin":1527,"imageOffsetTop":1279},"Daniel Rohregger","people/people-daniel-rohregger.jpg","/authors/daniel-rohregger","drohregger",{"display_name":525,"avatar":1529,"permalink":1530,"linkedin":1531,"imageOffsetTop":1378},"people/people-thomas-naunheim.jpg","/authors/thomas-naunheim","thomasnaunheim",{"display_name":1533,"avatar":1534,"permalink":1535,"linkedin":1536,"imageOffsetTop":1378},"Florian Stöckl","people/people-florian-stoeckl.jpg","/authors/florian-stoeckl","florianstoeckl",{"display_name":1538,"avatar":1539,"permalink":1540,"linkedin":1541,"imageOffsetTop":1378},"Pascal Asch","people/Pascal.Asch.648.jpg","/authors/pascal-asch","pascal-asch",{"display_name":1543,"avatar":1544,"permalink":1545,"linkedin":1546,"imageOffsetTop":1547,"imageOffsetLeft":1548},"Markus Kättner","people/markus-kaettner.jpg","/authors/markus-kaettner","markus-kättner-b600119","62%","63%",{"display_name":1550,"avatar":1551,"permalink":1552,"linkedin":1553,"imageOffsetTop":1554,"imageOffsetLeft":1555},"Anna Ulbricht","people/anna-katharina.ulbricht-09.png","/authors/anna-ulbricht","anna-katharina-u-a67702199","70%","50%",{"display_name":1557,"avatar":1558,"permalink":1559,"linkedin":1560,"imageOffsetTop":1561,"imageOffsetLeft":1306},"Annette Brauns","people/Annette-Brauns-8.jpg","/authors/annette-brauns","annette-brauns","95%",{"Fritz Zurhorst":1563,"Alexander Schlindwein":1564,"Sophie Luna":1565,"Nadine Klein":1566,"Karsten Kleinschmidt":1567,"Julian Wendt":1568,"Holger Bunkradt":1569,"Ralf Mania":1570,"Oliver Kieselbach":1571,"Steffen Schwerdtfeger":1572,"Gunnar Winter":1573,"Jan Petersen":1574,"Thorsten Kunzi":1575,"Moritz Pohl":1576,"Thorben Pöschus":1577,"Christoph Hannebauer":1578,"Marco Scheel":1579,"Christopher Brumm":1580,"Florian Klante":1581,"Niklas Bachmann":1582,"Nils Krautkrämer":1583,"Patrick Treptau":1584,"Peter Beckendorf":1585,"Patrick Sobau":1586,"Jörg Wunderlich":1587,"Michael Breither":1588,"Christian Kanja":1589,"Zeba Hoffmann":1590,"Jochen Fröhlich":1591,"Jan Geisbauer":1592,"Gerrit Reinke":1596,"Christian Kordel":1597,"Stephan Wälde":1598,"Carolin Kanja":1599,"Adrian Ritter":1600,"Marvin Bangert":1601,"Thorsten Pickhan":1602,"Christian Lorenz":1603,"Denis Böhm":1604,"Fabian Bader":1605,"Juan Jose Fernandez Perez":1606,"Mahschid Sayyar":1607,"Benjamin Dassow":1608,"Markus Walschburger":1609,"Jonathan Haist":1610,"Daniel Rohregger":1611,"Thomas Naunheim":1612,"Florian Stöckl":1613,"Pascal Asch":1614,"Markus Kättner":1615,"Anna Ulbricht":1616,"Annette Brauns":1617},{"display_name":1275,"avatar":1276,"permalink":1277,"linkedin":1278,"imageOffsetTop":1279},{"display_name":1281,"avatar":1282,"permalink":1283,"twitter":1284,"linkedin":1285},{"display_name":1287,"avatar":1288,"permalink":1289,"twitter":1290,"linkedin":1291,"imageOffsetLeft":1292,"imageOffsetTop":1293},{"display_name":1295,"avatar":1296,"permalink":1297,"twitter":1298,"linkedin":1299,"imageOffsetTop":1279},{"display_name":1301,"avatar":1302,"permalink":1303,"twitter":1304,"linkedin":1305,"imageOffsetTop":1306,"imageOffsetLeft":1307},{"display_name":1309,"avatar":1310,"permalink":1311,"linkedin":1312},{"display_name":1314,"avatar":1315,"permalink":1316,"linkedin":1317,"twitter":1318},{"display_name":1320,"avatar":1321,"permalink":1322,"linkedin":1323,"twitter":1324},{"display_name":1326,"avatar":1327,"permalink":1328,"linkedin":1329,"twitter":1330},{"display_name":1332,"avatar":1333,"permalink":1334,"linkedin":1335,"twitter":1336,"imageOffsetTop":1337,"imageOffsetLeft":1338},{"display_name":1340,"avatar":1341,"permalink":1342,"twitter":1290,"linkedin":1343},{"display_name":1345,"avatar":1346,"permalink":1347,"twitter":1290,"linkedin":1348},{"display_name":1350,"avatar":1351,"permalink":1352,"twitter":1290,"linkedin":1343,"imageOffsetTop":1279},{"display_name":1354,"avatar":1355,"permalink":1356,"twitter":1290,"linkedin":1357},{"display_name":1359,"avatar":1360,"permalink":1361,"twitter":1362,"linkedin":1363},{"display_name":1365,"avatar":1366,"permalink":1367,"twitter":1290,"linkedin":1343,"imageOffsetTop":1279},{"display_name":1369,"avatar":1370,"permalink":1371,"twitter":1372,"linkedin":1372},{"display_name":524,"avatar":1374,"permalink":1375,"twitter":1376,"linkedin":1377,"imageOffsetTop":1378},{"display_name":1380,"avatar":1381,"permalink":1382,"linkedin":1383,"twitter":1290},{"display_name":1385,"avatar":1386,"permalink":1387,"linkedin":1388,"twitter":1290},{"display_name":1390,"avatar":1391,"permalink":1392,"twitter":1393,"linkedin":1394},{"display_name":1396,"avatar":1397,"permalink":1398,"linkedin":1399,"twitter":1290},{"display_name":1401,"avatar":1402,"permalink":1403,"linkedin":1404,"twitter":1290,"imageOffsetTop":1279},{"display_name":1406,"avatar":1407,"permalink":1408,"linkedin":1409,"twitter":1290},{"display_name":1411,"avatar":1412,"permalink":1413,"twitter":1290},{"display_name":1415,"avatar":1416,"permalink":1417,"twitter":1290,"linkedin":1418},{"display_name":1420,"avatar":1421,"permalink":1422,"twitter":1423,"linkedin":1424},{"display_name":1426,"avatar":1427,"permalink":1428,"linkedin":1429,"twitter":1290},{"display_name":1431,"avatar":1432,"permalink":1433,"twitter":1290,"linkedin":1343},{"display_name":1435,"avatar":1436,"permalink":1437,"twitter":1438,"linkedin":1438,"imageOffsetTop":1279,"socials":1593},[1594,1595],{"text":472,"href":1441},{"text":1443,"href":1444},{"display_name":1446,"avatar":1447,"permalink":1448,"twitter":1449,"linkedin":1450},{"display_name":1452,"avatar":1453,"permalink":1454,"twitter":1290,"linkedin":1343},{"display_name":1456,"avatar":1457,"permalink":1458,"twitter":1459,"linkedin":1343},{"display_name":1461,"avatar":1462,"permalink":1463,"twitter":1464,"linkedin":1465},{"display_name":1467,"avatar":1468,"permalink":1469,"twitter":1470,"linkedin":1470},{"display_name":1472,"avatar":1473,"permalink":1474,"twitter":1475,"linkedin":1476},{"display_name":1478,"avatar":1479,"permalink":1480,"twitter":1481,"linkedin":1482},{"display_name":1484,"avatar":1485,"permalink":1486,"linkedin":1487,"twitter":1290},{"display_name":1489,"avatar":1490,"permalink":1491,"linkedin":1492,"twitter":1290},{"display_name":523,"avatar":1494,"permalink":1495,"linkedin":1496,"twitter":1497},{"display_name":1499,"avatar":1500,"permalink":1501,"linkedin":1502},{"display_name":1504,"avatar":1505,"permalink":1506,"linkedin":1507},{"display_name":1509,"avatar":1510,"permalink":1511,"linkedin":1512},{"display_name":1514,"avatar":1515,"permalink":1516,"linkedin":1517},{"display_name":1519,"avatar":1520,"permalink":1521,"linkedin":1522,"imageOffsetTop":1279},{"display_name":1524,"avatar":1525,"permalink":1526,"linkedin":1527,"imageOffsetTop":1279},{"display_name":525,"avatar":1529,"permalink":1530,"linkedin":1531,"imageOffsetTop":1378},{"display_name":1533,"avatar":1534,"permalink":1535,"linkedin":1536,"imageOffsetTop":1378},{"display_name":1538,"avatar":1539,"permalink":1540,"linkedin":1541,"imageOffsetTop":1378},{"display_name":1543,"avatar":1544,"permalink":1545,"linkedin":1546,"imageOffsetTop":1547,"imageOffsetLeft":1548},{"display_name":1550,"avatar":1551,"permalink":1552,"linkedin":1553,"imageOffsetTop":1554,"imageOffsetLeft":1555},{"display_name":1557,"avatar":1558,"permalink":1559,"linkedin":1560,"imageOffsetTop":1561,"imageOffsetLeft":1306},"Authors","1csawlkJxRljy93GTOnXEkwLqAv9Lcj-apxRvoodAOY",{"list":1621,"authors":1837},[1622,1639,1653,1667,1683,1696,1709,1722,1734,1750,1764,1779,1797,1808,1821],{"id":1623,"title":1624,"author":1625,"cta":494,"description":1172,"hideInRecent":484,"layout":1192,"meta":1626,"moment":1631,"path":1632,"stem":1633,"tags":1634,"webcast":484},"content_nl/posts/2026-09-22-end-of-mfa-sms.md","Het einde van de MFA-sms",[1301],{"lang":1194,"date":1627,"categories":1628,"blogtitlepic":1629,"customExcerpt":1630},"2026-09-21",[235],"head-conditional-access.jpg","Waarom organisaties nu moeten overstappen op phishingresistente en zo veel mogelijk wachtwoordloze aanmeldmethoden.","2026-09-22","/posts/2026-09-22-end-of-mfa-sms","posts/2026-09-22-end-of-mfa-sms",[235,1635,1636,1637,1638],"Authentication","Microsoft Entra ID","MFA","Passkeys",{"id":1640,"title":1641,"author":1642,"cta":494,"description":1172,"hideInRecent":484,"layout":1192,"meta":1643,"moment":1627,"path":1647,"stem":1648,"tags":1649,"webcast":484},"content_nl/posts/2026-09-21-clickfix-prevent-detect.md","ClickFix. Als de gebruiker de exploit is, en hoe jullie dat stoppen",[1275,1295],{"lang":1194,"date":1627,"categories":1644,"blogtitlepic":1645,"customExcerpt":1646},[235],"head-clickfix.jpg","ClickFix maakt gebruikers tot hun eigen aanvaller: een vals CAPTCHA, een copy-paste, en schadelijke code draait in het geheugen zonder dat er iets op de schijf landt. Hoe Microsoft Defender de aanval detecteert, waar de detectie tegen grenzen aanloopt en hoe jullie het gat dichten met een RunMRU-hunt en vier beschermingslagen.","/posts/2026-09-21-clickfix-prevent-detect","posts/2026-09-21-clickfix-prevent-detect",[1650,1651,1652],"Defender","SOC","Endpoint Security",{"id":1654,"title":1655,"author":1656,"cta":494,"description":1172,"hideInRecent":484,"layout":1192,"meta":1657,"moment":1627,"path":1661,"stem":1662,"tags":1663,"webcast":484},"content_nl/posts/2026-09-21-red-tenant-dark-tenant-cio.md","Admin en dagelijks werk op één computer? Game Over.",[1435],{"lang":1194,"date":1627,"categories":1658,"blogtitlepic":1659,"customExcerpt":1660},[235],"head-game-over-en.jpg","Waarom één tenant voor CIO's niet volstaat, en de tweede zelden wordt meegedacht. De Managed Red Tenant scheidt administratief werk architectonisch van de office-omgeving, de Managed Dark Tenant houdt de organisatie handelingsbekwaam wanneer de verdediging toch valt. Wat dat betekent voor het bedrijfsmodel, het SOC-signaal en de aantoonplichten volgens NISG 2026.","/posts/2026-09-21-red-tenant-dark-tenant-cio","posts/2026-09-21-red-tenant-dark-tenant-cio",[235,1664,1665,1666],"Privileged Access","Zero Trust","NIS2",{"id":1668,"title":1669,"author":1670,"cta":494,"description":1671,"hideInRecent":484,"layout":1192,"meta":1672,"moment":1673,"path":1678,"stem":1679,"tags":1680,"webcast":484},"content_nl/posts/2026-08-08-isg-germany-2026.md","Vier keer Leader. glueckkanja in de ISG-studie Duitsland 2026",[1461],"ISG heeft zijn studie dit jaar een andere naam gegeven. Van het Microsoft Cloud Ecosystem werd het Microsoft AI and Cloud Ecosystem, en met de naam is de maatstaf verschoven: beoordeeld wordt niet meer wie Microsoft-platformen invoert, maar wie Copilot, agents en AI-workloads beheersbaar draait. Aan onze positie heeft de nieuwe maatstaf niets veranderd. De ISG Provider Lens®-studie Duitsland 2026 positioneert ons als Leader in vier kwadranten: Microsoft Productivity and Business Process Services en Azure Managed Services, telkens in de Large Market en in de Mid Market. Na 2021, 2023, 2024 en 2025 is het de vijfde Leader-inschaling in Duitsland, in Zwitserland kwam de sprong naar het Leader-kwadrant twee weken eerder.",{"lang":1194,"date":1673,"categories":1674,"blogtitlepic":1676,"customExcerpt":1677},"2026-08-08",[1675],"Corporate","head-isg-de-2026.png","De ISG Provider Lens®-studie 2026 positioneert glueckkanja in Duitsland als Leader in vier kwadranten: Microsoft Productivity and Business Process Services en Azure Managed Services, telkens in de Large en in de Mid Market. De studie heet nu Microsoft AI and Cloud Ecosystem, en de maatstaf is verschoven: beoordeeld wordt wie AI- en agent-workloads beheersbaar draait.","/posts/2026-08-08-isg-germany-2026","posts/2026-08-08-isg-germany-2026",[1681,1682],"Award","ISG",{"id":1684,"title":1685,"author":1686,"cta":494,"description":1687,"hideInRecent":484,"layout":1192,"meta":1688,"moment":1689,"path":1693,"stem":1694,"tags":1695,"webcast":484},"content_nl/posts/2026-07-31-isg-switzerland-2026.md","Van Rising Star naar Leader. glueckkanja in de ISG-studie Zwitserland 2026",[1461],"In 2024 hebben we glueckkanja Switzerland AG opgericht en in het zentroom aan de Bahnhofplatz 10b in Bern een kantoor betrokken. In 2025 heeft ISG ons in de Zwitserse markt als Rising Star ingeschaald, als de aanbieder van wie de analisten de sprong naar het Leader-kwadrant verwachten. Nu is die sprong gedocumenteerd: de ISG Provider Lens®-studie 2026 positioneert ons in Zwitserland als Leader in het kwadrant Microsoft AI and Cloud Ecosystem, op de gebieden Azure Managed Services en Microsoft Productivity and Business Process Services.",{"lang":1194,"date":1689,"categories":1690,"blogtitlepic":1691,"customExcerpt":1692},"2026-07-31",[1675],"head-isg-ch-2026.png","De ISG Provider Lens®-studie 2026 positioneert glueckkanja in Zwitserland als Leader in het kwadrant Microsoft AI and Cloud Ecosystem, op de gebieden Azure Managed Services en Microsoft Productivity and Business Process Services. Twee jaar na de markttoetreding in Bern, een jaar na de Rising-Star-onderscheiding.","/posts/2026-07-31-isg-switzerland-2026","posts/2026-07-31-isg-switzerland-2026",[1681,1682],{"id":1697,"title":1698,"author":1699,"cta":494,"description":1172,"hideInRecent":484,"layout":1192,"meta":1700,"moment":1701,"path":1705,"stem":1706,"tags":1707,"webcast":484},"content_nl/posts/2026-07-24-outbreak-openai-hugging-face.md","Outbreak. Wat het OpenAI/Hugging-Face-incident verraadt en wat niet",[1435],{"lang":1194,"date":1701,"categories":1702,"blogtitlepic":1703,"customExcerpt":1704},"2026-07-24",[235],"head-outbreak.jpg","Een AI-agent breekt uit zijn testomgeving, vindt een zero-day en hackt een ander bedrijf. Klinkt als een scenario, maar is in juli 2026 daadwerkelijk gebeurd. Tijd voor een nuchtere plaatsbepaling: met wat psychologie, twee securityveteranen en de vraag wat dit voor jullie verdediging betekent.","/posts/2026-07-24-outbreak-openai-hugging-face","posts/2026-07-24-outbreak-openai-hugging-face",[1708,1651,1665],"AI",{"id":1710,"title":1711,"author":1712,"cta":494,"description":1713,"hideInRecent":484,"layout":1192,"meta":1714,"moment":1715,"path":1719,"stem":1720,"tags":1721,"webcast":484},"content_nl/posts/2026-07-22-isg-cybersecurity-2026.md","Leader en Rising Star. glueckkanja in de ISG Cybersecurity-studie 2026",[1461],"Nieuw in het kwadrant en meteen Leader: de ISG Provider Lens®-studie \"Cybersecurity – Services and Solutions 2026\" positioneert glueckkanja als Leader op het gebied van Next-Gen SOC/MDR Services voor de Duitse midmarket. In de totale markt voor Next-Gen SOC/MDR Services onderscheidt ISG ons als Rising Star, dus als de aanbieder van wie de analisten de sprong naar het Leader-kwadrant binnen de komende 12 tot 24 maanden verwachten.",{"lang":1194,"date":1715,"categories":1716,"blogtitlepic":1717,"customExcerpt":1718},"2026-07-22",[1675],"head-isg-cybersecurity-2026.png","De ISG Provider Lens®-studie Cybersecurity 2026 onderscheidt glueckkanja als Leader in het kwadrant Next-Gen SOC/MDR Services (Midmarket). In de totale markt voor Next-Gen SOC/MDR Services zijn we Rising Star. ISG schrijft ons bovengemiddelde groei toe, diepgaande Microsoft-securityexpertise en een 24/7 SOC vanuit Duitsland.","/posts/2026-07-22-isg-cybersecurity-2026","posts/2026-07-22-isg-cybersecurity-2026",[1681,1682,235],{"id":1723,"title":1724,"author":1725,"cta":494,"description":1726,"hideInRecent":484,"layout":1192,"meta":1727,"moment":1728,"path":1731,"stem":1732,"tags":1733,"webcast":484},"content_nl/posts/2026-07-06-the-holy-trinity.md","The Holy Trinity: wat AI echt nodig heeft om te werken",[1461],"Een productiebedrijf wil weten welke van zijn 14.000 SKU's daadwerkelijk winstgevend zijn. Het antwoord ligt in drie systemen die nog nooit één enkel datapunt met elkaar hebben uitgewisseld. Tot voor kort kostte het drie afdelingen, twee weken en de nodige goede wil om dat antwoord te krijgen. Sinds begin 2026 kan een AI die vraag in minuten beantwoorden: de data doorzoeken, verbanden leggen, een aanbeveling produceren. Op voorwaarde dat ze toegang heeft.",{"lang":1194,"date":1728,"categories":1729,"blogtitlepic":1730},"2026-07-06",[131],"head-the-holy-trinity","/posts/2026-07-06-the-holy-trinity","posts/2026-07-06-the-holy-trinity",[1708,131],{"id":1735,"title":1736,"author":1737,"cta":494,"description":1738,"hideInRecent":484,"layout":1192,"meta":1739,"moment":1740,"path":1744,"stem":1745,"tags":1746,"webcast":484},"content_nl/posts/2026-07-01-onboarding-process.md","Contract ondertekend: zo verloopt jouw onboarding bij ons",[1550],"Hoe verloopt jullie onboarding eigenlijk? Een vraag die we in gesprekken met sollicitanten steeds opnieuw tegenkomen, want velen hebben al eens meegemaakt dat een onboarding hobbelig verloopt. Des te belangrijker is het voor ons om je vanaf het begin een goed gevoel te geven.",{"lang":1194,"date":1740,"categories":1741,"blogtitlepic":1742,"customExcerpt":1743},"2026-07-01",[1675],"Onboarding_Blogheader","Het contract is ondertekend, de eerste grote stap is gezet. Maar hoe gaat het nu verder? We nemen je mee achter de schermen van onze onboarding, van het PreBoarding tot de eerste week in het team.","/posts/2026-07-01-onboarding-process","posts/2026-07-01-onboarding-process",[1747,1748,1749],"Employer Branding","Onboarding","Unternehmenskultur",{"id":1751,"title":1752,"author":1753,"cta":494,"description":1754,"hideInRecent":484,"layout":1192,"meta":1755,"moment":1756,"path":1760,"stem":1761,"tags":1762,"webcast":484},"content_nl/posts/2026-06-26-frontier-partner.md","Microsoft Frontier Partner: wij horen erbij",[1461],"In het Microsoft-partnerecosysteem bestaat een hele reeks erkenningen, en toch onderscheidt de Frontier Partner Badge zich in opzet van de andere onderscheidingen. Je kunt hem niet aanvragen, want Microsoft kent hem op eigen initiatief toe aan een exclusieve groep partners die in meerdere disciplines tegelijk moeten overtuigen in plaats van in één enkele te schitteren. Microsoft toetst daarbij aangetoonde competentie in Cloud & AI Platforms, in AI Business Solutions en in Security in gelijke mate en richt zich daarmee op organisaties die AI niet zien als opzetstuk op bestaande IT, maar als resultaat van een doorlopende architectuur die van identiteit via endpoint tot in productieve AI-operations draagt.",{"lang":1194,"date":1756,"categories":1757,"blogtitlepic":1758,"customExcerpt":1759},"2026-06-26",[1675],"head-frontier-partner-badge.jpg","Sinds kort bestaat er binnen het Microsoft AI Cloud Partner Program een nieuwe toponderscheiding, de Frontier Partner Badge. Microsoft kent die uitsluitend toe aan een exclusieve groep partners wereldwijd die AI-projecten op de volledige Microsoft-stack draagkrachtig leveren, van de workplace via het cloudplatform en security tot in de AI-toepassing zelf, en die dat in de praktijk hebben aangetoond. In de DACH-regio telt die groep slechts een handvol bedrijven, en wij zijn er een van.","/posts/2026-06-26-frontier-partner","posts/2026-06-26-frontier-partner",[1681,1763,1708],"Microsoft Partner",{"id":1765,"title":1766,"author":1767,"cta":494,"description":1768,"hideInRecent":484,"layout":1192,"meta":1769,"moment":1770,"path":1774,"stem":1775,"tags":1776,"webcast":484},"content_nl/posts/2026-06-09-vair-run.md","160 kilometer voor het goede doel",[1557],"Zondagochtend, 8:30 uur, Holbeinsteg aan de Main. Elf collega's in dezelfde NinjaCat-shirts, klaar voor de Frankfurter Runden. Regen, bliksem en donder inbegrepen. Voor een goed doel lopen was motivatie genoeg om ondanks het slechte weer de hardloopschoenen aan te trekken.",{"lang":1194,"date":1770,"categories":1771,"blogtitlepic":1772,"customExcerpt":1773},"2026-06-08",[1675],"frankfurter-runden.png","Elf collega's, 16 rondes, 160 kilometer, een onweersfront en een podiumplek: glueckkanja deed mee aan de Frankfurter Runden 2026 en doneerde voor elke gelopen ronde aan VAIR e.V., die in Offenbach een inclusief sport- en cultuurpark bouwt.","/posts/2026-06-09-vair-run","posts/2026-06-09-vair-run",[1777,1747,1778],"Top Arbeitgeber","Soziales Engagement",{"id":1780,"title":1781,"author":1782,"cta":494,"description":1783,"hideInRecent":484,"layout":1192,"meta":1784,"moment":1785,"path":1789,"stem":1790,"tags":1791,"webcast":484},"content_nl/posts/2026-04-10-incident-to-intelligence.md","Anatomie van een onbekende AMOS Stealer: van alert naar immuniteit in enkele uren",[1538],"Wanneer in ons SOC een alert afgaat, begint de klok te lopen: niet alleen voor de getroffen klant, maar voor alle organisaties onder onze bescherming. Het gevaarlijkste moment in het huidige dreigingslandschap is de intelligence gap, het tijdvenster tussen de eerste inzet van een nieuwe malwarevariant en de dag waarop de branche daarvan hoort.",{"lang":1194,"date":1785,"categories":1786,"blogtitlepic":1787,"customExcerpt":1788},"2026-04-10",[235],"head-amos-stealer.png","Een tot dan toe ongedocumenteerde AMOS-stealervariant compromitteerde een macOS-endpoint. Geen bekende hashes, geen C2-gegevens in openbare databases. Ons SOC haalde zes obfuscatielagen uit elkaar, extraheerde alle indicatoren en verdeelde de bescherming binnen enkele uren over alle SOC-klanten, nog voordat de branche het sample had gezien.","/posts/2026-04-10-incident-to-intelligence","posts/2026-04-10-incident-to-intelligence",[1792,1793,1794,1795,1796],"Threat Intelligence","Incident Response","macOS Security","Malware Analysis","Cyber Security Operations Center",{"id":1798,"title":1799,"author":1800,"cta":494,"description":1801,"hideInRecent":484,"layout":1192,"meta":1802,"moment":1803,"path":1806,"stem":1807,"tags":494,"webcast":484},"content_nl/posts/2026-03-21-microsoft-edge-corporate-browser.md","Waarom Edge jullie enige corporate browser zou moeten zijn",[1332],"De keuze van de browser is in bedrijfsomgevingen een strategische beslissing: die bepaalt direct hoeveel security en hoeveel beheerlast je werkelijk hebt. Google Chrome was lang de voor de hand liggende optie, maar Microsoft Edge is uitgegroeid tot een browser die direct ingrijpt op de bestaande stack, vooral wanneer Microsoft 365 in gebruik is en het beheer via Intune loopt.",{"lang":1194,"date":1803,"blogtitlepic":1804,"customExcerpt":1805},"2026-03-21","head-microsoft-edge-default-browser.jpg","Geen enkele organisatie heeft Chrome echt gekozen; hij was er simpelweg, met eigen sync-logica, eigen accountbeheer en een eigen interface voor policies. Microsoft Edge grijpt daarentegen direct in op de infrastructuur die toch al draait: Entra ID, Intune, Defender. Deze post laat zien hoe de overstap eruitziet, hoe Chrome via een Intune-policy naar een landingpage wordt omgeleid en wat er wegvalt zodra je stopt met het parallel beheren van twee browsers.","/posts/2026-03-21-microsoft-edge-corporate-browser","posts/2026-03-21-microsoft-edge-corporate-browser",{"id":1809,"title":1810,"author":1811,"cta":494,"description":1812,"hideInRecent":484,"layout":1192,"meta":1813,"moment":1814,"path":1818,"stem":1819,"tags":1820,"webcast":484},"content_nl/posts/2026-03-20-stryker-attack-intune-privilege.md","Eén adminaccount was alles wat er nodig was.",[1435],"Woensdag 11 maart 2026. Medewerkers in Stryker-kantoren in 79 landen zetten hun computers aan en vonden ze leeg. Inlogschermen vervangen door een logo. Bedrijfslaptops, zakelijke telefoons, privéapparaten die in het BYOD-programma van het bedrijf waren geregistreerd, allemaal gelijktijdig gewist, in één nacht. Geen ransomware, geen malwaresignaturen, niets wat een endpoint-detectietool had kunnen opmerken.",{"lang":1194,"date":1814,"categories":1815,"blogtitlepic":1816,"customExcerpt":1817},"2026-03-20",[235],"head-stryker.jpg","Op 11 maart 2026 wiste Handala apparaten in 79 landen, en alles wat daarvoor nodig was, was één gecompromitteerd Intune-adminaccount. Geen malware, geen exploit, alleen legitieme managementtools die tegen hun eigenaars werden gericht. Wat er is gebeurd, waarom het werkte en welke twee architectonische gaten gedicht moeten worden.","/posts/2026-03-20-stryker-attack-intune-privilege","posts/2026-03-20-stryker-attack-intune-privilege",[71,1664,1665],{"id":1822,"title":1823,"author":1824,"cta":494,"description":1825,"hideInRecent":484,"layout":1192,"meta":1826,"moment":1827,"path":1831,"stem":1832,"tags":1833,"webcast":484},"content_nl/posts/2026-03-16-ai-agent-hackathon.md","Zes agents. Vier weken. Echt in productie.",[1461],"Hoeveel uur per week besteedt jullie IT-afdeling aan taken die een agent in minuten afhandelt?",{"lang":1194,"date":1827,"categories":1828,"blogtitlepic":1829,"customExcerpt":1830},"2026-03-16",[1675],"head-ai-agent-hackathon.jpg","Zes bedrijven, vier weken build-fase, zes werkende AI agents: dat was de eerste glueckkanja AI Agent Hackathon. Kiekert, Dr. Oetker, Eckes-Granini, igefa en lila logistik hebben in Copilot Studio agents gebouwd die vandaag productief lopen. Wat daarbij ontstond en hoe het format werkt.","/posts/2026-03-16-ai-agent-hackathon","posts/2026-03-16-ai-agent-hackathon",[1708,1834,1835,1836],"Copilot Studio","Hackathon","AI Agents",{"Karsten Kleinschmidt":1838,"Fritz Zurhorst":1839,"Nadine Klein":1840,"Jan Geisbauer":1841,"Carolin Kanja":1845,"Anna Ulbricht":1846,"Annette Brauns":1847,"Pascal Asch":1848,"Steffen Schwerdtfeger":1849},{"display_name":1301,"avatar":1302,"permalink":1303,"twitter":1304,"linkedin":1305,"imageOffsetTop":1306,"imageOffsetLeft":1307},{"display_name":1275,"avatar":1276,"permalink":1277,"linkedin":1278,"imageOffsetTop":1279},{"display_name":1295,"avatar":1296,"permalink":1297,"twitter":1298,"linkedin":1299,"imageOffsetTop":1279},{"display_name":1435,"avatar":1436,"permalink":1437,"twitter":1438,"linkedin":1438,"imageOffsetTop":1279,"socials":1842},[1843,1844],{"text":472,"href":1441},{"text":1443,"href":1444},{"display_name":1461,"avatar":1462,"permalink":1463,"twitter":1464,"linkedin":1465},{"display_name":1550,"avatar":1551,"permalink":1552,"linkedin":1553,"imageOffsetTop":1554,"imageOffsetLeft":1555},{"display_name":1557,"avatar":1558,"permalink":1559,"linkedin":1560,"imageOffsetTop":1561,"imageOffsetLeft":1306},{"display_name":1538,"avatar":1539,"permalink":1540,"linkedin":1541,"imageOffsetTop":1378},{"display_name":1332,"avatar":1333,"permalink":1334,"linkedin":1335,"twitter":1336,"imageOffsetTop":1337,"imageOffsetLeft":1338},{"id":1270,"extension":1271,"meta":1851,"stem":8,"__hash__":1619},{"Christopher Brumm":1852,"Fabian Bader":1853,"Thomas Naunheim":1854},{"display_name":524,"avatar":1374,"permalink":1375,"twitter":1376,"linkedin":1377,"imageOffsetTop":1378},{"display_name":523,"avatar":1494,"permalink":1495,"linkedin":1496,"twitter":1497},{"display_name":525,"avatar":1529,"permalink":1530,"linkedin":1531,"imageOffsetTop":1378},1791383941894]