[{"data":1,"prerenderedAt":1857},["ShallowReactive",2],{"sc:header-data-sv":3,"sc:footer-data-sv":489,"post-sv--posts-2025-01-14-compliant-device-bypass-184506556cb284":519,"authors_data":1270,"content-sv-list-7b291c2dd91a4":1622,"authors_data:Christopher Brumm|Fabian Bader|Thomas Naunheim":1852},{"lang":4,"home":5,"navigation":17,"meta":479,"contact":485},"de",{"name":6,"folderSwitch":7,"imgLight":10,"img":11,"languages":12},"home",[8,9],"authors","blog","/logos/gk-Logo-sw.svg","/logos/gk-Logo-rgb.svg",{"sv":13},{"title":14,"url":15,"alt":16},"Hem","/sv","glueckkanja Logo",[18,127,231,316,395,402],{"name":19,"languages":20,"children":24},"workplace",{"sv":21},{"title":22,"description":23},"Workplace","Microsoft 365-driven för smarta, säkra och flexibla arbetsmiljöer som förenar den senaste tekniken och identitetslösningar.",[25,55,91],{"name":26,"languages":27,"children":30},"portfolio",{"sv":28},{"title":29},"Portfolio",[31,37,43,49],{"name":32,"languages":33},"managed-intune",{"sv":34},{"title":35,"url":36},"Managed Intune","/sv/entra-intune/managed-intune",{"name":38,"languages":39},"managed-entra",{"sv":40},{"title":41,"url":42},"Managed Entra","/sv/entra-intune/managed-entra",{"name":44,"languages":45},"managed-workplace",{"sv":46},{"title":47,"url":48},"Managed Workplace","/sv/workplace/managed-workplace",{"name":50,"languages":51},"consulting-services",{"sv":52},{"title":53,"url":54},"Consulting Services","/sv/workplace/consulting-services",{"name":56,"languages":57,"children":60},"microsoft-365-endpoint",{"sv":58},{"title":59},"Microsoft 365 Endpoint",[61,67,73,79,85],{"name":62,"languages":63},"microsoft-entra-suite",{"sv":64},{"title":65,"url":66},"Microsoft Entra Suite","/sv/workplace/microsoft-entra-suite",{"name":68,"languages":69},"microsoft-intune",{"sv":70},{"title":71,"url":72},"Microsoft Intune","/sv/workplace/microsoft-intune",{"name":74,"languages":75},"microsoft-windows",{"sv":76},{"title":77,"url":78},"Microsoft Windows","/sv/workplace/microsoft-windows",{"name":80,"languages":81},"windows-365-cloud-pc",{"sv":82},{"title":83,"url":84},"Windows 365 Cloud PC","/sv/workplace/windows365-cloud-pc",{"name":86,"languages":87},"cloud-workplace-foundation",{"sv":88},{"title":89,"url":90},"Cloud Workplace Foundation","/sv/workplace/cloud-workplace-foundation",{"name":92,"languages":93,"children":96},"microsoft-365-collaboration",{"sv":94},{"title":95},"Microsoft 365 Collaboration",[97,103,109,115,121],{"name":98,"languages":99},"microsoft-copilot",{"sv":100},{"title":101,"url":102},"Microsoft 365 Copilot","/sv/workplace/microsoft-365-copilot",{"name":104,"languages":105},"microsoft-teams",{"sv":106},{"title":107,"url":108},"Teams","/sv/workplace/microsoft-teams",{"name":110,"languages":111},"sharepoint-powerplatform",{"sv":112},{"title":113,"url":114},"SharePoint & Power Platform","/sv/workplace/sharepoint-power-platform",{"name":116,"languages":117},"exchange-online",{"sv":118},{"title":119,"url":120},"Exchange Online","/sv/workplace/exchange-online",{"name":122,"languages":123},"information-protection-compliance",{"sv":124},{"title":125,"url":126},"Information Protection & Compliance","/sv/workplace/information-protection-compliance",{"name":128,"languages":129,"children":133},"azure",{"sv":130},{"title":131,"description":132},"Azure","Driv tillväxt med Azure: Sänk molnkostnaderna, öka effektiviteten och driv innovation genom IaaS och PaaS.",[134,151,181],{"name":135,"languages":136,"children":138},"azure-portfolio",{"sv":137},{"title":29},[139,145],{"name":140,"languages":141},"azure-managed-services",{"sv":142},{"title":143,"url":144},"Azure Managed Services","/sv/azure/azure-managed-services",{"name":146,"languages":147},"azure-consulting",{"sv":148},{"title":149,"url":150},"Azure Consulting","/sv/azure/azure-consulting",{"name":152,"languages":153,"children":156},"azure-scenarios",{"sv":154},{"title":155},"Scenarier",[157,163,169,175],{"name":158,"languages":159},"plan-your-cloud",{"sv":160},{"title":161,"url":162},"Planera ditt moln","/sv/azure/plan-your-cloud",{"name":164,"languages":165},"migrate-to-the-cloud",{"sv":166},{"title":167,"url":168},"Migrera till molnet","/sv/azure/migrate-to-the-cloud",{"name":170,"languages":171},"innovate-your-business",{"sv":172},{"title":173,"url":174},"Förnya din verksamhet","/sv/azure/innovate-your-business",{"name":176,"languages":177},"vmware-exit",{"sv":178},{"title":179,"url":180},"Ompröva din VMware-strategi","/sv/azure/vmware-exit",{"name":182,"languages":183,"children":186},"azure-practices",{"sv":184},{"title":185},"Practices",[187,193,199,202,208,213,219,225],{"name":188,"languages":189},"azure-foundation",{"sv":190},{"title":191,"url":192},"Azure Foundation","/sv/azure/azure-foundation",{"name":194,"languages":195},"azure-ai-foundation",{"sv":196},{"title":197,"url":198},"Azure AI Foundation","/sv/azure/azure-ai-foundation",{"name":86,"languages":200},{"sv":201},{"title":89,"url":90},{"name":203,"languages":204},"azure-data-foundation",{"sv":205},{"title":206,"url":207},"Azure Data Foundation","/sv/azure/azure-data-foundation",{"name":188,"languages":209},{"sv":210},{"title":211,"url":212},"Azure Container Foundation","/sv/azure/azure-container-foundation",{"name":214,"languages":215},"dark-tenant",{"sv":216},{"title":217,"url":218},"Managed Dark Tenant","/sv/azure/managed-dark-tenant",{"name":220,"languages":221},"azure-cloud-adoption-framework",{"sv":222},{"title":223,"url":224},"Cloud Adoption Framework","/sv/azure/cloud-adoption-framework",{"name":226,"languages":227},"azure-cloud-competence-center",{"sv":228},{"title":229,"url":230},"Cloud Competence Center","/sv/azure/cloud-competence-center",{"name":232,"languages":233,"children":242},"security",{"sv":234},{"title":235,"description":236,"emergency":237},"Säkerhet","Vaksamhet i molnet med en prisbelönt managed service dygnet runt, incident response och toppmodernt skydd för din infrastruktur.",{"text":238,"href":239,"skin":240,"icon":241},"Attackerad?","/sv/security/are-you-under-attack","primary","emergency",[243,268,289],{"name":244,"children":245},"security-security-consulting",[246,252,256,262],{"name":247,"languages":248},"managed-red-tenant",{"sv":249},{"title":250,"url":251},"Managed Red Tenant","/sv/security/managed-red-tenant",{"name":214,"languages":253},{"sv":254},{"title":255,"url":218},"Dark Tenant",{"name":257,"languages":258},"sentinel-data-lake",{"sv":259},{"title":260,"url":261},"Sentinel Data Lake","/sv/security/sentinel-data-lake",{"name":263,"languages":264},"security-consulting",{"sv":265},{"title":266,"url":267},"Security Consulting","/sv/security/security-consulting",{"name":269,"children":270},"security-cloud-security-operations-center",[271,277,283],{"name":272,"languages":273},"cloud-security-operations-center",{"sv":274},{"title":275,"url":276},"Cloud Security Operations Center","/sv/security/cloud-security-operations-center",{"name":278,"languages":279},"global-secure-access",{"sv":280},{"title":281,"url":282},"Global Secure Access","/sv/security/global-secure-access",{"name":284,"languages":285},"my-work-id",{"sv":286},{"title":287,"url":288},"MyWorkID","/sv/security/my-work-id",{"name":290,"children":291},"security-preventive-services",[292,298,304,310],{"name":293,"languages":294},"preventive-services",{"sv":295},{"title":296,"url":297},"Preventive Services","/sv/security/preventive-services",{"name":299,"languages":300},"data-security-services",{"sv":301},{"title":302,"url":303},"Data Security Service","/sv/security/data-security-service",{"name":305,"languages":306},"security-copilot-agents",{"sv":307},{"title":308,"url":309},"Security Copilot Agents","/sv/security/security-copilot-agents",{"name":311,"languages":312},"nis2",{"sv":313},{"title":314,"url":315},"Implementera NIS2","/sv/security/red-dark-tenant-nis2",{"name":317,"languages":318,"children":322},"products",{"sv":319},{"title":320,"description":321},"Produkter","Innovativa kompletterande produkter för en helt säker, 100% cloud-native Microsoft-miljö som förbättrar samarbete, nätverksautentisering och programvaruhantering.",[323,360],{"name":324,"products":325,"children":326},"lorem ipsum 1",true,[327,336,344,352],{"name":328,"img":329,"target":330,"languages":331},"realmjoin","products/realmjoin/realmjoin-nav-logo.svg","_blank",{"sv":332},{"title":333,"url":334,"subtitle":335},"RealmJoin","https://www.realmjoin.com","Molnbaserad programvarudistribution",{"name":337,"img":338,"target":330,"languages":339},"scepman","products/scepman/scepman-nav-logo.svg",{"sv":340},{"title":341,"url":342,"subtitle":343},"SCEPman","https://www.scepman.com","Certifikatdistribution från molnet",{"name":345,"img":346,"target":330,"languages":347},"konnekt","products/konnekt/konnekt-nav-logo.svg",{"sv":348},{"title":349,"url":350,"subtitle":351},"KONNEKT","https://www.konnekt.io","Arbeta lokalt med dina Office 365-data",{"name":353,"img":354,"target":330,"languages":355},"realmigrator","products/realmigrator/realmigrator-nav-logo.svg",{"sv":356},{"title":357,"url":358,"subtitle":359},"RealMigrator","https://www.realmigrator.com","Migrera dina data från en server till en annan",{"name":361,"products":325,"children":362},"lorem ipsum 2",[363,371,379,387],{"name":364,"img":365,"target":330,"languages":366},"terraprovider","products/terraprovider/terraprovider-nav-logo.svg",{"sv":367},{"title":368,"url":369,"subtitle":370},"TerraProvider","https://www.terraprovider.com","Terraform Provider för Microsoft 365",{"name":372,"img":373,"target":330,"languages":374},"radiusaas","products/radius/radius-nav-logo.svg",{"sv":375},{"title":376,"url":377,"subtitle":378},"RADIUSaaS","https://www.radius-as-a-service.com","Autentisering för ditt nätverk",{"name":380,"img":381,"target":330,"languages":382},"unifiedcontacts","products/unified-contacts/unifiedcontact-nav-logo.svg",{"sv":383},{"title":384,"url":385,"subtitle":386},"Unified Contacts","https://www.unified-contacts.com","Hitta kontakter i Microsoft Teams",{"name":388,"img":389,"target":330,"languages":390},"autopilotmonitor","products/autopilot-monitor/AutopilotMonitor-nav-logo.svg",{"sv":391},{"title":392,"url":393,"subtitle":394},"Autopilot Monitor","https://www.autopilotmonitor.com","Windows Autopilot-övervakning i realtid",{"name":396,"languages":397},"casestudies",{"sv":398},{"title":399,"url":400,"description":401},"Kundcase","/sv/casestudies","Pionjär i molnet: Din främsta Microsoft-partner för heltäckande molnlösningar med ett Blueprint-baserat tillvägagångssätt och expertis inom Infrastructure-as-Code.",{"name":403,"languages":404,"children":407},"company",{"sv":405},{"title":406,"description":401},"Företag",[408,438,462],{"name":409,"languages":410,"children":413},"company-about-us",{"sv":411},{"title":412},"Om oss",[414,420,426,432],{"name":415,"languages":416},"company-facts-figures",{"sv":417},{"title":418,"url":419},"Fakta och siffror","/sv/company/facts-and-figures",{"name":421,"languages":422},"company-contact",{"sv":423},{"title":424,"url":425},"Kontakt och platser","/sv/company/contact-and-locations",{"name":427,"languages":428},"switzerland",{"sv":429},{"title":430,"url":431},"glueckkanja Schweiz","/sv/company/switzerland",{"name":433,"languages":434},"austria",{"sv":435},{"title":436,"url":437},"glueckkanja Österrike","/sv/company/austria",{"name":439,"languages":440,"children":443},"company-career",{"sv":441},{"title":442},"Karriär",[444,450,456],{"name":445,"languages":446},"company-career-overview",{"sv":447},{"title":448,"url":449},"Karriäröversikt","/sv/career",{"name":451,"languages":452},"company-young-professionals",{"sv":453},{"title":454,"url":455},"Young Professionals","/sv/young-professionals",{"name":457,"languages":458},"company-jobs",{"sv":459},{"title":460,"url":461},"Lediga jobb","/sv/job-offers",{"name":463,"languages":464,"children":467},"company-latest",{"sv":465},{"title":466},"Aktuellt",[468,474],{"name":469,"languages":470},"company-blog",{"sv":471},{"title":472,"url":473},"Blogg","/sv/blog",{"name":469,"languages":475},{"sv":476},{"title":477,"url":478},"Event","/sv/events",[480],{"name":481,"languages":482},"career-meta",{"sv":483},{"title":442,"url":449,"active":484},false,{"languages":486},{"sv":487},{"title":488,"url":425,"active":484},"Kontakt",{"data":490},{"bgColor":491,"number":492,"mail":493,"brandLogos":494,"logos":495,"links":499,"linksSv":509},"var(--color-gk-mid-blue)","+49 69 4005520","info@glueckkanja.com",null,[496],{"img":10,"alt":16,"url":497,"class":498},"index.html","max-w-19rem",[500,503,506],{"title":501,"url":502},"Datenschutz","/de/privacy",{"title":504,"url":505},"Impressum","/de/imprint",{"title":507,"url":508},"No Cookies","/de/cookies",[510,513,516],{"title":511,"url":512},"Integritetspolicy","/sv/privacy",{"title":514,"url":515},"Juridisk information","/sv/imprint",{"title":517,"url":518},"Inga cookies","/sv/cookies",{"id":520,"title":521,"author":522,"body":526,"cta":494,"description":1172,"eventid":494,"extension":1191,"hideInRecent":484,"layout":1192,"meta":1193,"moment":1197,"navigation":325,"path":1262,"seo":1263,"stem":1264,"tags":1265,"webcast":484,"__hash__":1269},"content_sv/posts/2025-01-14-compliant-device-bypass.md","Compliant Device Bypass - allt du behöver veta",[523,524,525],"Fabian Bader","Christopher Brumm","Thomas Naunheim",{"type":527,"value":528,"toc":1171},"minimal",[529,534,538,592,596,598,611,619,630,636,639,643,645,650,653,656,660,726,729,732,736,738,742,744,759,766,769,772,774,777,780,783,791,802,805,807,810,814,816,819,824,828,830,833,836,839,1002,1006,1008,1011,1051,1055,1057,1064,1067,1070,1085,1088,1091,1145,1153,1157,1159,1162,1165,1168],[530,531,533],"h2",{"id":532},"vad-har-hänt-hittills","Vad har hänt hittills?",[535,536,537],"p",{},"{: .h3-font-size}",[539,540,541,565,580,589],"ul",{},[542,543,544,545,552,553,558,559,564],"li",{},"I december 2024 höll ",[546,547,551],"a",{"href":548,"rel":549},"https://x.com/TEMP43487580",[550],"nofollow","Yuya Chudo"," sitt föredrag ”",[546,554,557],{"href":555,"rel":556},"https://www.blackhat.com/eu-24/briefings/schedule/#unveiling-the-power-of-intune-leveraging-intune-for-breaking-into-your-cloud-and-on-premise-42176",[550],"Unveiling the Power of Intune: Leveraging Intune for Breaking Into Your Cloud and On-Premise","” på konferensen Black Hat Europe. I sessionen visade han hur man kan missbruka ett hårdkodat och föga känt undantag i Conditional Access (CA) för enhetsefterlevnad i kombination med den odokumenterade ”",[546,560,563],{"href":561,"rel":562},"https://github.com/secureworks/family-of-client-ids-research",[550],"FOCI-funktionen","” i Entra ID. I föredraget presenterade han även svaret från Microsoft MSRC (VULN-123240) om att det här beteendet är avsiktligt och krävs för att nya enheter ska kunna genomföra Intune Enrollment.",[542,566,567,568,573,574,579],{},"Några dagar efter konferensen publicerade Sunny Chau proof-of-concept-verktyget ",[546,569,572],{"href":570,"rel":571},"https://github.com/JumpsecLabs/TokenSmith",[550],"TokenSmith"," tillsammans med ett ",[546,575,578],{"href":576,"rel":577},"https://labs.jumpsec.com/tokensmith-bypassing-intune-compliant-device-conditional-access/",[550],"medföljande blogginlägg",", vilket gjorde tekniken tillgänglig för en bredare publik.",[542,581,582,583,588],{},"Dessutom har en ",[546,584,587],{"href":585,"rel":586},"https://github.com/zh54321/PoCEntraDeviceComplianceBypass/blob/main/poc_entra_compliance_bypass.ps1",[550],"PoC skriven i PowerShell"," publicerats.",[542,590,591],{},"Sedan slutet av december har vi på glueckkanja AG undersökt hur den här tekniken kan förhindras och detekteras. I det här blogginlägget vill vi dela med oss av några av våra insikter om attacken och diskutera möjligheter till åtgärder och detektering.",[530,593,595],{"id":594},"tldr","TL;DR",[535,597,537],{},[535,599,600,601,606,607],{},"Det finns vissa resurser med ett inbyggt undantag från specifika Grant Controls/Conditions i Conditional Access för att lösa särskilda problem. Ett av dem är undantaget för Company Portal-appen från Device Compliance, som löser hönan-och-ägget-problemet med att få enheter registrerade i Intune innan de betraktas som efterlevande. Det här beteendet är ",[546,602,605],{"href":603,"rel":604},"https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-alt-all-users-compliant-hybrid-or-mfa#:~:text=You%20can%20enroll,Company%20Portal%20application",[550],"dokumenterat här",".\n",[608,609,610],"strong",{},"Det innebär att du kan hämta access- och refresh-token för den här appen från en ohanterad enhet, även om en CA-policy tvingar fram Device Compliance för ”All resources”.",[535,612,613,618],{},[614,615],"img",{"alt":616,"src":617},"image.png","https://res.cloudinary.com/c4a8/image/upload/blog/pics/company-portal-ca-bypass-02.png","{: .post__screenshot}",[535,620,621,622,626,627],{},"Microsoft har implementerat en funktion som kallas Family of Client IDs (FOCI), som tillåter en grupp Microsoft OAuth-klientapplikationer att hämta access-token som vilken annan klient som helst i familjen med hjälp av sin refresh-token. Ett beteende som annars inte är tillåtet enligt OAuth2-standarden. Läs ",[546,623,625],{"href":561,"rel":624},[550],"Secureworks ursprungliga arbete"," för mer detaljer.\n",[608,628,629],{},"Eftersom Company Portal-appen är en ”familjemedlem” kan de begärda refresh-token för den användas för att hämta token för andra appar i familjen.",[535,631,632,633],{},"FOCI-funktionen är begränsad och samtycket mellan client id och resursen måste konfigureras och beviljas uttryckligen. För Company Portal-appen har det här samtycket bland annat beviljats för åtkomst till Microsoft Graph med ett begränsat scope och till Azure AD Graph API med den aktuella användarens behörighet.\n",[608,634,635],{},"Det innebär att en refresh-token för Company Portal kan användas för att hämta exempelvis access-token för Azure AD Graph API med scopet user_impersonation, vilket låter oss göra en hel del saker med till exempel AADInternals eller ROADrecon.",[535,637,638],{},"För att genomföra attacken behöver angriparen antingen giltiga inloggningsuppgifter för offret samt möjlighet att utföra MFA om Conditional Access kräver det, eller en giltig refresh-token.",[530,640,642],{"id":641},"vilken-risk-och-vilket-skadeomfång-finns","Vilken risk och vilket skadeomfång finns?",[535,644,537],{},[646,647,649],"h3",{"id":648},"vilka-av-de-möjliga-resurserna-scopes-påverkas-av-efterlevnadsundantaget","Vilka av de möjliga resurserna (scopes) påverkas av efterlevnadsundantaget?",[535,651,652],{},"{: .h4-font-size}",[535,654,655],{},"Angriparen har möjlighet att begära token för en annan FOCI-applikation, som redan beskrivits ovan. Microsoft har dock endast implementerat ett kringgående av kraven på enhetsefterlevnad för åtkomst av token till vissa resursapplikationers olika API-behörighets-scopes. I synnerhet är följande delegerade API-behörigheter känsliga och av intresse för angripare:",[657,658,659],"style",{},"\ntable {\n  font-family: arial, sans-serif;\n  border-collapse: collapse;\n  width: 100%;\n}\n\ntd, th {\n  border: 1px solid #dddddd;\n  text-align: left;\n  padding: 8px;\n}\n\ntr:nth-child(even) {\n  background-color: #dddddd;\n}\n",[661,662,663,679],"table",{},[664,665,666],"thead",{},[667,668,669,673,676],"tr",{},[670,671,672],"th",{},"Resource Application",[670,674,675],{},"Application Id",[670,677,678],{},"Delegated Permission Scope",[680,681,682,694,705,716],"tbody",{},[667,683,684,688,691],{},[685,686,687],"td",{},"AADGraph",[685,689,690],{},"00000002-0000-0000-c000-000000000000",[685,692,693],{},"user_impersonation",[667,695,696,699,702],{},[685,697,698],{},"Microsoft Graph API",[685,700,701],{},"00000003-0000-0000-c000-000000000000",[685,703,704],{},"“email\", \"openid\", \"profile\",\"Device.Read.All\", \"DeviceManagementConfiguration.Read.All\", \"DeviceManagementConfiguration.ReadWrite.All\", \"ServicePrincipalEndpoint.Read.All\", \"User.Read”",[667,706,707,710,713],{},[685,708,709],{},"Device Registration Service",[685,711,712],{},"01cb2876-7ebd-4aa4-9cc9-d28bd4d359a9",[685,714,715],{},"adrs_access",[667,717,718,721,724],{},[685,719,720],{},"Windows Azure Service Management API",[685,722,723],{},"797f4846-ba00-4fd7-ba43-dac1f8f63013",[685,725,693],{},[535,727,728],{},"Eftersom de beviljade behörigheterna inte gäller själva applikationen beror påverkan på anroparens (användarkontots) privilegier och på vilka delegerade behörighets-scopes som är auktoriserade att utföra API-anrop inom scopet.",[535,730,731],{},"Låt oss titta närmare på hur kritiskt det visade delegerade behörighets-scopet är och på potentiell auktorisering att anropa känsliga API:er.",[530,733,735],{"id":734},"vilka-privilegier-och-delegerade-scopes-är-kritiska","Vilka privilegier och delegerade scopes är kritiska?",[535,737,537],{},[646,739,741],{"id":740},"azure-ad-graph-api","Azure AD Graph API",[535,743,652],{},[535,745,746,747,752,753,758],{},"Det äldre programmatiska gränssnittet erbjuder många API:er för att hantera kataloginställningar och objekt i Entra ID (Azure AD). Det inkluderar Conditional Access-policyer, katalogroller, CRUD på grupper och enheter samt operationer på den inloggade användaren, till exempel byte av lösenord. En fullständig lista över alla operationer som stöds finns i ",[546,748,751],{"href":749,"rel":750},"https://learn.microsoft.com/en-us/previous-versions/azure/ad/graph/api/api-catalog",[550],"referensen för Azure AD Graph API",". Det här API:et tas ur bruk helt den 30 juni 2025 (enligt ",[546,754,757],{"href":755,"rel":756},"https://learn.microsoft.com/en-us/graph/migrate-azure-ad-graph-overview",[550],"Microsofts senaste tillkännagivanden",").",[535,760,761,762,765],{},"Det tilldelade delegerade scopet ”user_impersonation” tillåter applikationen (i det här fallet Company Portal) att agera för användarens räkning. Varje behörighet som den inloggade användaren har till ett Entra-objekt, ett scope eller på katalognivå kan alltså användas som auktorisering i API-anropen. Användaren kan vara ägare till ett Entra ID-objekt (applikation, grupp eller andra objekt), eller ha tilldelats behörigheter via Entra ID-rolltilldelningar. ",[608,763,764],{},"Vid aktiva högprivilegierade rolltilldelningar skulle detta tillåta angriparen att ändra objekt eller kompromettera tenanten."," I värsta fall, även helt utan privilegier, kan standardbehörigheterna för användare utnyttjas för omfattande spaning och uppräkning av katalogobjekt i tenanten.",[535,767,768],{},"Scenarierna och påverkan av att missbruka Azure AD Graph API beror därför på den drabbade användarens aktiva eller permanent tilldelade privilegier. API:er för åtkomst till Microsoft 365-tjänster (till exempel för exfiltrering av OneDrive) ingår inte i Azure AD Graph.",[646,770,698],{"id":771},"microsoft-graph-api",[535,773,652],{},[535,775,776],{},"Jämfört med Azure AD Graph är det delegerade scopet till Microsoft Graph API begränsat till ett visst scope. Vid sidan av OpenID-scopes (openid, email, profile) och grundläggande läsoperationer för användarens räkning (ServicePrincipalEndpoint.Read.All, User.Read).",[535,778,779],{},"Att lista och läsa alla enhetsobjekt kan göras genom att anropa ”device”-endpointen i Microsoft Graph med standardbehörigheter via ”Device.Read.All”. Detta kan hjälpa angripare att få insikt i enhetsobjekt.",[535,781,782],{},"Om en komprometterad användare har tilldelats ”Intune Administrator” eller någon delegering i Microsoft Intune RBAC bör följande beviljade delegerade API-behörigheter betraktas som problematiska:",[539,784,785,788],{},[542,786,787],{},"”DeviceManagementConfiguration.Read.All”",[542,789,790],{},"”DeviceManagementConfiguration.ReadWrite.All”",[535,792,793],{},[608,794,795,796,801],{},"De här delegerade behörigheterna tillåter CRUD-operationer, exempelvis på Device Compliance- och Configuration Policies, men även distribution av ",[546,797,800],{"href":798,"rel":799},"https://learn.microsoft.com/en-us/graph/api/intune-shared-devicemanagementscript-create?view=graph-rest-beta",[550],"Management Scripts"," för vidare skadlig aktivitet på målenheter.",[646,803,709],{"id":804},"device-registration-service",[535,806,652],{},[535,808,809],{},"Med den här behörigheten kan angriparen ansluta eller registrera en enhet till Entra ID. Detta gör i sin tur att de till och med kan registrera enheten i Intune och, beroende på Intune-konfigurationen, få en giltig och efterlevande enhet för att komma åt ännu fler skyddade tjänster.",[646,811,813],{"id":812},"andra-foci-applikationer","Andra FOCI-applikationer",[535,815,652],{},[535,817,818],{},"Att begära åtkomst till andra privilegierade gränssnitt, till exempel Azure Resource Manager API, ligger inom ramen för FOCI och är också av intresse för angriparen. Den här resursen är dock fortfarande skyddad och kringgås inte av grant-kontrollen ”compliant device” i Conditional Access.",[535,820,821],{},[614,822],{"alt":616,"src":823},"https://res.cloudinary.com/c4a8/image/upload/blog/pics/company-portal-ca-bypass-03.png",[530,825,827],{"id":826},"kan-vi-detektera-den-här-attacktekniken","Kan vi detektera den här attacktekniken?",[535,829,537],{},[535,831,832],{},"Som beskrivits ovan kommer den största risken från åtkomst till MS Graph och Azure AD Graph.",[535,834,835],{},"Eftersom applikations-ID:t för Microsoft Intune Company Portal-appen alltid används i det här fallet är huvuduppgiften vid utformningen av en detektering att utesluta legitim användning genom till exempel enhetsregistreringar. Enligt vår observation handlar detta om vilka resurser som först nås i en session → vid en attack vanligtvis MS Graph eller Azure AD Graph.",[535,837,838],{},"Här är en fungerande detektering som vi har testat i flera miljöer av olika storlek:",[840,841,843,844,847,848,853,854,858,862,865,866,868,865,872,847,874,876,877,865,881,883,865,886,847,888,890,891,893,865,896,847,898,900,901,904,905,908,909,912,913,847,915,918,919,921,865,924,847,926,904,929,931,932,934,935,937,938,865,941,934,943,946,947,950,951,953,954,918,957,959,865,962,847,964,966,967,847,969,971,972,865,975,977,865,979,847,981,876,983,865,985,987,865,990,847,992,900,994,904,996,908,998,912,1000],"div",{"style":842},"background-color:#000000; font-family: 'Source Code Pro', 'Courier New', monospace; padding: 15px; color: #ffffff","\nAADSignInEventsBeta ",[845,846],"br",{},"\n| ",[849,850,852],"span",{"style":851},"color: #569CD6;","where"," Timestamp > ",[849,855,857],{"style":856},"color: #E6DB74;","ago(",[849,859,861],{"style":860},"color: #A6E22E;","7d",[849,863,864],{"style":856},")"," ",[845,867],{},[849,869,871],{"style":870},"color: #75715E;","// Access to Microsoft Intune Company Portal",[845,873],{},[849,875,852],{"style":851}," ApplicationId == ",[849,878,880],{"style":879},"color: #D69D85;","@\"9ba1a5c7-f17a-4de9-a1f1-6178c8d51223\"",[845,882],{},[849,884,885],{"style":870},"// From non joined/registered device",[845,887],{},[849,889,852],{"style":851}," isempty(AadDeviceId) ",[845,892],{},[849,894,895],{"style":870},"// Used to access resource Microsoft Graph or Windows Azure Active Directory",[845,897],{},[849,899,852],{"style":851}," ResourceId ",[849,902,903],{"style":851},"in"," (",[849,906,907],{"style":879},"\"00000002-0000-0000-c000-000000000000\"",", ",[849,910,911],{"style":879},"\"00000003-0000-0000-c000-000000000000\"",") ",[845,914],{},[849,916,917],{"style":851},"summarize by"," SessionId ",[845,920],{},[849,922,923],{"style":870},"// Find the initial logon event based on the session Id",[845,925],{},[849,927,928],{"style":851},"join kind=inner",[845,930],{},"\n    AADSignInEventsBeta ",[845,933],{},"\n    | ",[849,936,852],{"style":851}," ErrorCode == ",[849,939,940],{"style":860},"0",[845,942],{},[849,944,945],{"style":851},"summarize arg_min(","Timestamp, *",[849,948,949],{"style":851},") by"," SessionId)",[845,952],{},"\n    ",[849,955,956],{"style":851},"on",[845,958],{},[849,960,961],{"style":870},"// Ignore trusted and managed devices",[845,963],{},[849,965,852],{"style":851}," isempty(DeviceTrustType) ",[845,968],{},[849,970,852],{"style":851}," IsManaged != ",[849,973,974],{"style":860},"1",[845,976],{},[849,978,871],{"style":870},[845,980],{},[849,982,852],{"style":851},[849,984,880],{"style":879},[845,986],{},[849,988,989],{"style":870},"// when the first requested resource is Microsoft Graph or Windows Azure Active Directory",[845,991],{},[849,993,852],{"style":851},[849,995,903],{"style":851},[849,997,907],{"style":879},[849,999,911],{"style":879},[845,1001],{},[530,1003,1005],{"id":1004},"hur-bör-vi-reagera-när-vi-detekterar-misstänkta-aktiviteter","Hur bör vi reagera när vi detekterar misstänkta aktiviteter?",[535,1007,537],{},[535,1009,1010],{},"Starta din incident response-process med en definierad playbook som innehåller:",[539,1012,1013,1034,1042,1045,1048],{},[542,1014,1015,1016],{},"Jakt efter misstänkt eller avvikande aktivitet från den komprometterade användaren\n",[539,1017,1018,1025,1028,1031],{},[542,1019,1020,1021],{},"Sammanställning av icke-interaktiva inloggningar till resursapplikationer, inklusive IP-adresser och UserAgents, baserat på ",[1022,1023,1024],"code",{},"sessionId",[542,1026,1027],{},"Kontroll av om Microsoft Entra Audit Logs visar kritiska operationer utförda av användaren eller IP-adresserna (till exempel tillagda credentials på egna app-registreringar)",[542,1029,1030],{},"Identifiering av om användaren har registrerat enheter i den drabbade sessionen",[542,1032,1033],{},"Kontroll av Intune-granskningsloggarna efter operationer från applikationen ”Company Portal” och den drabbade användaren",[542,1035,1036,1037],{},"Jakt efter relaterade larm hos de påverkade entiteterna\n",[539,1038,1039],{},[542,1040,1041],{},"Sökning efter entiteter i tabellen AlertEvidence för att identifiera andra larm baserat på SessionId, IP-adresser och användare",[542,1043,1044],{},"Identifiering av användarens kritikalitet (utifrån privilegier) i Exposure Management",[542,1046,1047],{},"Granskning av jaktresultaten och verifiering av om åtgärden var legitim som en del av en enhetsregistrering.",[542,1049,1050],{},"Identifiering av den initiala åtkomstvektorn och återställning av användarens inloggningsuppgifter och vid behov enheter.",[530,1052,1054],{"id":1053},"kan-vi-åtgärda-attacken","Kan vi åtgärda attacken?",[535,1056,537],{},[535,1058,1059,1060,1063],{},"Eftersom det konfigurerade undantaget krävs för Intune-registrering ",[608,1061,1062],{},"finns det ingen åtgärd som inte samtidigt bryter andra delar av Microsoft 365."," Åtkomst till Azure AD Graph-resursen kan inte begränsas i scope eller blockeras direkt. Varje Conditional Access-policy som använder ”Block” som grant-kontroll förhindrar åtkomst, men kan få andra konsekvenser.",[535,1065,1066],{},"För åtgärder är det dock avgörande att förstå att det här kringgåendet av Conditional Access inte är en fullständig attack. Det är en teknik som utgör ett steg som möjliggör en rad attacker.",[535,1068,1069],{},"En attackväg kan vara",[1071,1072,1073,1076,1079,1082],"ol",{},[542,1074,1075],{},"Kontokompromettering via phishing och AiTM",[542,1077,1078],{},"Kringgående av Conditional Access",[542,1080,1081],{},"Spaning med till exempel ROADrecon, GraphRunner eller AADInternals",[542,1083,1084],{},"Lateral förflyttning, privilegieeskalering eller persistens via en nyregistrerad enhet som registrerats i Intune",[535,1086,1087],{},"Eftersom vi inte kan åtgärda kringgåendet av Conditional Access utan att bryta Intune-registreringen är det mer än rimligt att införa åtgärder i attackvägens övriga steg och även införa rimliga detekteringar.",[535,1089,1090],{},"För att minska sannolikhet och påverkan föreslår vi att du stärker andra kontroller och snart inför följande:",[539,1092,1093,1099,1105,1111,1117,1133,1139],{},[542,1094,1095,1098],{},[608,1096,1097],{},"Tvinga fram MFA för ”All Users” och ”All Cloud Apps” via Conditional Access."," Om du bara tvingar fram Device Compliance räcker enfaktorsautentisering med den här tekniken.",[542,1100,1101,1104],{},[608,1102,1103],{},"Använd inte Device Compliance eller MFA i dina regeluppsättningar, tvinga alltid fram båda."," Att använda OR skulle aldrig begränsa all åtkomst till efterlevande enheter, eftersom en access-token med MFA i scope skulle räcka för att komma åt tenanten.",[542,1106,1107,1110],{},[608,1108,1109],{},"Begränsa registrering av säkerhetsinformation till efterlevande enheter, phishing-resistent autentisering eller TAP."," I våra tester lyckades vi inte kringgå Device Compliance för registrering av säkerhetsinformation.",[542,1112,1113,1116],{},[608,1114,1115],{},"Kräv phishing-resistent autentisering eller TAP för att ansluta eller registrera enheter."," Utan det går det att registrera en enhet med till exempel AADInternals och den här tekniken.",[542,1118,1119,1122,1123],{},[608,1120,1121],{},"Kräv MFA och ”Sign-in frequency every time” för Microsoft Intune Enrollment."," Detta begränsar tidsspannet under vilket en angripare kan använda färska inloggningsuppgifter för att registrera en ny enhet i Intune.\n",[1124,1125,1126],"blockquote",{},[535,1127,1128,1129,1132],{},"🚧\n",[608,1130,1131],{},"Observera: Sign-in frequency every time = var femte minut","\nMicrosoft räknar med fem minuters klockavvikelse när ”every time” väljs i en Conditional Access-policy, så att användare inte tillfrågas oftare än en gång var femte minut.",[542,1134,1135,1138],{},[608,1136,1137],{},"Blockera privatägda enheter i Intune Enrollment-restriktionerna."," Utan de här restriktionerna kan en angripare registrera en ny enhet och skaffa sig ytterligare fotfäste.",[542,1140,1141,1144],{},[608,1142,1143],{},"Ställ in att enhetsefterlevnad ska misslyckas när ingen efterlevnadspolicy är tilldelad en enhet i Intune."," Som standard betraktas varje enhet som efterlevande, även om ingen policy faktiskt tillämpas. Ändra detta och gör en enhetsefterlevnadspolicy till ett krav.",[535,1146,1147,1148,1152],{},"På lång sikt vill vi uppmuntra dig att investera i att rulla ut lösenordsfri, phishing-resistent autentisering som Windows Hello for Business och Passkeys (inklusive Platform Credentials via macOS Platform SSO). Det gör att du därefter kan tvinga fram phishing-resistent autentisering och blockera AiTM-attacker. Tillåt i stället för lösenord användning av Temporary Access Pass (TAP) under begränsad tid och för särskilda scenarier, till exempel onboarding av nya enheter eller medarbetare. För att stödja användningen av TAP i olika användningsfall har vi byggt ",[546,1149,287],{"href":1150,"rel":1151},"https://myworkid.cloud/",[550],".",[530,1154,1156],{"id":1155},"slutsats","Slutsats",[535,1158,537],{},[535,1160,1161],{},"Conditional Access som Zero Trust-motor för Entra ID är i sig redan komplicerat. Microsofts inbyggda undantag i Entras backend gör det ännu svårare för många att förstå vilken påverkan policyer och skydd har. Ändå håller idén om Zero Trust och djupförsvar.",[535,1163,1164],{},"Enhetsefterlevnadspolicyn förhindrar de flesta AiTM-attacker och multifaktorautentisering gör det svårare för en angripare att missbruka läckta eller på annat sätt komprometterade inloggningsuppgifter.",[535,1166,1167],{},"Alla de här säkerhetsåtgärderna måste användas tillsammans och inte den ena i stället för den andra. Det säkerställer en säker miljö, även om något av försvaren manipuleras eller kringgås.",[535,1169,1170],{},"Vi rekommenderar starkt att du distribuerar den tillhandahållna detekteringen i Microsoft Defender XDR för att säkerställa att potentiellt missbruk upptäcks. Se till att din SOC är beredd att utreda sådana incidenter och förse dem med nödvändiga playbooks.",{"title":1172,"searchDepth":1173,"depth":1173,"links":1174},"",2,[1175,1176,1177,1181,1187,1188,1189,1190],{"id":532,"depth":1173,"text":533},{"id":594,"depth":1173,"text":595},{"id":641,"depth":1173,"text":642,"children":1178},[1179],{"id":648,"depth":1180,"text":649},3,{"id":734,"depth":1173,"text":735,"children":1182},[1183,1184,1185,1186],{"id":740,"depth":1180,"text":741},{"id":771,"depth":1180,"text":698},{"id":804,"depth":1180,"text":709},{"id":812,"depth":1180,"text":813},{"id":826,"depth":1173,"text":827},{"id":1004,"depth":1173,"text":1005},{"id":1053,"depth":1173,"text":1054},{"id":1155,"depth":1173,"text":1156},"md","post",{"lang":1194,"seoTitle":1195,"titleClass":1196,"date":1197,"categories":1198,"blogtitlepic":1200,"socialimg":1201,"customExcerpt":1202,"keywords":1203,"contactInContent":1204,"scripts":1261},"sv","Compliant Device Bypass i Microsoft Intune: detektering, respons och åtgärder","h2-font-size","2025-01-14",[1199],"Security","header-company-portal-ca-bypass","/blog/heads/header-company-portal-ca-bypass.png","I det här blogginlägget samlar glueckkanjas MVP Fabian Bader, Chris Brumm och Thomas Naunheim detaljerna om Compliant Device Bypass i Microsoft Intune Company Portal. Efter ytterligare efterforskningar har de hittat ett sätt att detektera och reagera på det potentiella hotet. Du får också vägledning om Conditional Access för att minska attackytan samt detaljer om skadeomfånget.","Compliant Device Bypass, Microsoft Intune, Conditional Access, Entra ID, Intune Company Portal, enhetsefterlevnad, CA-undantag, TokenSmith PoC, molnsäkerhet, PowerShell PoC, Fabian Bader, Christopher Brumm, Thomas Naunheim, säkerhetshot, Black Hat Europe, Intune Enrollment, MSRC-respons, attackdetektering, hotåtgärder, molnefterlevnad, FOCI-funktion",{"quote":484,"infos":1205},{"bgColor":1206,"color":1207,"boxBgColor":1208,"boxColor":1209,"headline":1210,"subline":1211,"level":530,"textStyling":1212,"flush":1213,"person":1214,"form":1226},"var(--color-gk-violet)","var(--color-gk-white)","var(--color-gk-yellow)","var(--color-copy)","Kontakta oss nu","Vill du veta mer om Compliant Device Bypass och hur du detekterar och åtgärdar den effektivt? Våra experter går gärna igenom våra rön med dig och stöttar dig med beprövade strategier för bättre säkerhet. Vi ser fram emot att höra från dig!","text-light","justify-content-end",{"image":1215,"cloudinary":325,"alt":1216,"name":1216,"detailsHeader":1217,"details":1218},"/people/people-pam-team.png","Project & Account Management","Vi ser fram emot att höra från dig!",[1219,1223],{"text":492,"href":1220,"details":1221,"icon":1222},"tel:+49 69 4005520","Ring nu","site/phone",{"text":493,"href":1224,"icon":1225},"mailto:info@glueckkanja.com","site/mail",{"ctaText":1227,"cta":1228,"method":1192,"action":1230,"fields":1231},"Skicka",{"skin":1229},"primary on-surface","/send",[1232,1236,1241,1244,1248,1253,1256,1259],{"type":1233,"id":1234,"value":1235},"hidden","_next","successful",{"label":1237,"type":1238,"id":1239,"required":325,"requiredMsg":1240},"Namn*","text","name","Ange ditt namn.",{"label":1242,"type":1238,"id":403,"required":325,"requiredMsg":1243},"Företag*","Ange ditt företag.",{"label":1245,"type":1246,"id":1246,"required":325,"requiredMsg":1247},"E-postadress*","email","Ange din e-postadress.",{"label":1249,"type":1250,"id":1251,"required":325,"requiredMsg":1252},"Dina uppgifter lagras hos oss för att behandla och besvara din förfrågan. Mer information om dataskydd hittar du i vår \u003Ca href=\"/sv/privacy\">integritetspolicy\u003C/a>.","checkbox","dataprotection","Bekräfta",{"type":1233,"id":1254,"value":1255},"_subject","Request Global Secure Access",{"type":1233,"id":1257,"value":1258},"inbox_key","gkgab-contact-form",{"type":1233,"id":1260},"_gotcha",{"slick":325,"form":325},"/posts/2025-01-14-compliant-device-bypass",{"title":521,"description":1172},"posts/2025-01-14-compliant-device-bypass",[1199,1266,1267,1268,281],"Entra","Conditional Access","ITDR","1GVyErqY3FszR4Cl_pgsHs2Y4winpxngHWFOnKuv7tw",{"id":1271,"extension":1272,"meta":1273,"stem":8,"__hash__":1621},"authors_data/authors.json","json",{"path":1274,"Fritz Zurhorst":1275,"Alexander Schlindwein":1281,"Sophie Luna":1287,"Nadine Klein":1295,"Karsten Kleinschmidt":1301,"Julian Wendt":1309,"Holger Bunkradt":1314,"Ralf Mania":1320,"Oliver Kieselbach":1326,"Steffen Schwerdtfeger":1332,"Gunnar Winter":1340,"Jan Petersen":1345,"Thorsten Kunzi":1350,"Moritz Pohl":1354,"Thorben Pöschus":1359,"Christoph Hannebauer":1365,"Marco Scheel":1369,"Christopher Brumm":1374,"Florian Klante":1380,"Niklas Bachmann":1385,"Nils Krautkrämer":1390,"Patrick Treptau":1396,"Peter Beckendorf":1401,"Patrick Sobau":1406,"Jörg Wunderlich":1411,"Michael Breither":1415,"Christian Kanja":1420,"Zeba Hoffmann":1426,"Jochen Fröhlich":1431,"Jan Geisbauer":1435,"Gerrit Reinke":1447,"Christian Kordel":1453,"Stephan Wälde":1457,"Carolin Kanja":1462,"Adrian Ritter":1468,"Marvin Bangert":1473,"Thorsten Pickhan":1479,"Christian Lorenz":1485,"Denis Böhm":1490,"Fabian Bader":1495,"Juan Jose Fernandez Perez":1500,"Mahschid Sayyar":1505,"Benjamin Dassow":1510,"Markus Walschburger":1515,"Jonathan Haist":1520,"Daniel Rohregger":1525,"Thomas Naunheim":1530,"Florian Stöckl":1534,"Pascal Asch":1539,"Markus Kättner":1544,"Anna Ulbricht":1551,"Annette Brauns":1558,"body":1564,"title":1620},"/authors",{"display_name":1276,"avatar":1277,"permalink":1278,"linkedin":1279,"imageOffsetTop":1280},"Fritz Zurhorst","people/people-fritz-zurhorst.png","/authors/fritz-zurhorst","friedemann-z","72%",{"display_name":1282,"avatar":1283,"permalink":1284,"twitter":1285,"linkedin":1286},"Alexander Schlindwein","people/people-alexander-rudolph.png","/authors/alexander-schlindwein","AlexanderOnIT","schlindwein-alexander",{"display_name":1288,"avatar":1289,"permalink":1290,"twitter":1291,"linkedin":1292,"imageOffsetLeft":1293,"imageOffsetTop":1294},"Sophie Luna","people/people-sophie-luna.jpg","/authors/sophie-luna","glueckkanjagab","../company/glueckkanja-gab","58%","67%",{"display_name":1296,"avatar":1297,"permalink":1298,"twitter":1299,"linkedin":1300,"imageOffsetTop":1280},"Nadine Klein","people/people-nadine-kern.png","/authors/nadine-kern","nadineausRT","nadine-kern",{"display_name":1302,"avatar":1303,"permalink":1304,"twitter":1305,"linkedin":1306,"imageOffsetTop":1307,"imageOffsetLeft":1308},"Karsten Kleinschmidt","/c_pad,w_800,h_700/people/karsten-kleinschmidt.jpg","/authors/karsten-kleinschmidt","KarstenonIT","karstenkleinschmidt","60%","57%",{"display_name":1310,"avatar":1311,"permalink":1312,"linkedin":1313},"Julian Wendt","people/people-julian-wendt.png","/authors/julian-wendt","julian-wendt",{"display_name":1315,"avatar":1316,"permalink":1317,"linkedin":1318,"twitter":1319},"Holger Bunkradt","people/people-holger-bunkradt.png","/authors/holger-bunkradt","holger-bunkradt-12b5053b","hbunkradt",{"display_name":1321,"avatar":1322,"permalink":1323,"linkedin":1324,"twitter":1325},"Ralf Mania","people/people-ralf-mania.png","/authors/ralf-mania","ralf-mania-146a2757","RaMa1976",{"display_name":1327,"avatar":1328,"permalink":1329,"linkedin":1330,"twitter":1331},"Oliver Kieselbach","people/people-oliver-kieselbach.png","/authors/oliver-kieselbach","oliver-kieselbach-a4a3409","okieselbT",{"display_name":1333,"avatar":1334,"permalink":1335,"linkedin":1336,"twitter":1337,"imageOffsetTop":1338,"imageOffsetLeft":1339},"Steffen Schwerdtfeger","people/people-steffen-schwerdtfeger.png","/authors/steffen-schwerdtfeger","steffen-schwerdtfeger","SteffenAtCloud","79%","51%",{"display_name":1341,"avatar":1342,"permalink":1343,"twitter":1291,"linkedin":1344},"Gunnar Winter","people/people-gunnar-winter.jpg","/authors/gunnar-winter","company/glueckkanja-gab",{"display_name":1346,"avatar":1347,"permalink":1348,"twitter":1291,"linkedin":1349},"Jan Petersen","people/jan-petersen.png","/authors/jan-petersen","jan-petersen-26a901",{"display_name":1351,"avatar":1352,"permalink":1353,"twitter":1291,"linkedin":1344,"imageOffsetTop":1280},"Thorsten Kunzi","people/author-thorsten-kunzi.png","/authors/thorsten-kunzi",{"display_name":1355,"avatar":1356,"permalink":1357,"twitter":1291,"linkedin":1358},"Dr. Moritz Pohl","people/people-moritz-pohl.png","/authors/moritz-pohl","dr-moritz-pohl",{"display_name":1360,"avatar":1361,"permalink":1362,"twitter":1363,"linkedin":1364},"Thorben Pöschus","people/thorben.poeschus.png","/authors/thorben-poeschus","TPO901","thorben-pöschus-624693b7",{"display_name":1366,"avatar":1367,"permalink":1368,"twitter":1291,"linkedin":1344,"imageOffsetTop":1280},"Dr. Christoph Hannebauer","people/people-christoph-hannebauer.png","/authors/christoph-hannebauer",{"display_name":1370,"avatar":1371,"permalink":1372,"twitter":1373,"linkedin":1373},"Marco Scheel","people/people-marco-scheel.png","/authors/marco-scheel","marcoscheel",{"display_name":524,"avatar":1375,"permalink":1376,"twitter":1377,"linkedin":1378,"imageOffsetTop":1379},"people/people-christopher-brumm.jpg","/authors/christopher-brumm","cbrhh","christopherbrumm","66%",{"display_name":1381,"avatar":1382,"permalink":1383,"linkedin":1384,"twitter":1291},"Florian Klante","people/florian-klante.jpg","/authors/florian-klante","florian-klante-6031b31b",{"display_name":1386,"avatar":1387,"permalink":1388,"linkedin":1389,"twitter":1291},"Niklas Bachmann","people/niklas.bachmann.png","/authors/niklas-bachmann","niklas-bachmann-66a863158",{"display_name":1391,"avatar":1392,"permalink":1393,"twitter":1394,"linkedin":1395},"Nils Krautkrämer","people/nils-krautkraemer.png","/authors/nils-krautkraemer","KrauNils","nils-krautkrämer-8b04bb250",{"display_name":1397,"avatar":1398,"permalink":1399,"linkedin":1400,"twitter":1291},"Patrick Treptau","people/people-patrick-treptau.png","/authors/patrick-traptau","ptreptau",{"display_name":1402,"avatar":1403,"permalink":1404,"linkedin":1405,"twitter":1291,"imageOffsetTop":1280},"Peter Beckendorf","people/peter-beckendorf.png","/authors/peter-beckendorf","peter-beckendorf-29a239b1",{"display_name":1407,"avatar":1408,"permalink":1409,"linkedin":1410,"twitter":1291},"Patrick Sobau","people/patrick-sobau.png","/authors/patrick-sobau","patrick-sobau",{"display_name":1412,"avatar":1413,"permalink":1414,"twitter":1291},"Jörg Wunderlich","people/joerg-wunderlich.png","/authors/joerg-wunderlich",{"display_name":1416,"avatar":1417,"permalink":1418,"twitter":1291,"linkedin":1419},"Michael Breither","people/people-michael-breither.jpg","/authors/michael-breither","michaelbreither",{"display_name":1421,"avatar":1422,"permalink":1423,"twitter":1424,"linkedin":1425},"Christian Kanja","people/people-christian-kanja.png","/authors/christian-kanja","cekageka","christian-kanja",{"display_name":1427,"avatar":1428,"permalink":1429,"linkedin":1430,"twitter":1291},"Zeba Hoffmann","people/zeba-hoffmann.png","/authors/zeba-hoffmann","zebahoffmann",{"display_name":1432,"avatar":1433,"permalink":1434,"twitter":1291,"linkedin":1344},"Jochen Fröhlich","people/people-jochen-froehlich.png","/authors/jochen-froehlich",{"display_name":1436,"avatar":1437,"permalink":1438,"twitter":1439,"linkedin":1439,"imageOffsetTop":1280,"socials":1440},"Jan Geisbauer","people/people-jan-geisbauer-csoc.png","/authors/jan-geisbauer","JanGeisbauer",[1441,1444],{"text":1442,"href":1443},"Blog","https://emptydc.com",{"text":1445,"href":1446},"Podcast","https://hairlessinthecloud.com",{"display_name":1448,"avatar":1449,"permalink":1450,"twitter":1451,"linkedin":1452},"Gerrit Reinke","people/gerrit-reinke.png","/authors/gerrit-reinke","GLWRe","glwr",{"display_name":1454,"avatar":1455,"permalink":1456,"twitter":1291,"linkedin":1344},"Christian Kordel","people/christian-kordel.png","/authors/christian-kordel",{"display_name":1458,"avatar":1459,"permalink":1460,"twitter":1461,"linkedin":1344},"Stephan Wälde","people/people-stephan-waelde.png","/authors/stephan-waelde","stephanwaelde",{"display_name":1463,"avatar":1464,"permalink":1465,"twitter":1466,"linkedin":1467},"Carolin Kanja","people/people-carolin-kanja.jpg","/authors/carolin-kanja","fraukanja","carolin-kanja",{"display_name":1469,"avatar":1470,"permalink":1471,"twitter":1472,"linkedin":1472},"Adrian Ritter","people/people-adrian-ritter.png","/authors/adrian-ritter","adrianritter",{"display_name":1474,"avatar":1475,"permalink":1476,"twitter":1477,"linkedin":1478},"Marvin Bangert","people/people-marvin-bangert.png","/authors/marvin-bangert","marvinbangert","marvin-bangert",{"display_name":1480,"avatar":1481,"permalink":1482,"twitter":1483,"linkedin":1484},"Thorsten Pickhan","people/people-thorsten-pickhan.png","/authors/thorsten-pickhan","tpickhan","thorsten-pickhan",{"display_name":1486,"avatar":1487,"permalink":1488,"linkedin":1489,"twitter":1291},"Christian Lorenz","people/people-christian-lorenz.png","/authors/christian-lorenz","christianlorenz95",{"display_name":1491,"avatar":1492,"permalink":1493,"linkedin":1494,"twitter":1291},"Denis Böhm","people/people-denis-boehm.png","/authors/denis-boehm","denis-böhm-3bb834135",{"display_name":523,"avatar":1496,"permalink":1497,"linkedin":1498,"twitter":1499},"people/people-fabian-bader.jpg","/authors/fabian-bader","fabianbader","fabian_bader",{"display_name":1501,"avatar":1502,"permalink":1503,"linkedin":1504},"Juan Jose Fernandez Perez","people/people-juan-jose-fernandez.jpg","/authors/juan-jose-fernandez-perez","juan-jose-fernandez-perez-8016055",{"display_name":1506,"avatar":1507,"permalink":1508,"linkedin":1509},"Mahschid Sayyar","people/people-mahschid-sayyar.jpg","/authors/mahschid-sayyar","mahschid-sayyar-97544463",{"display_name":1511,"avatar":1512,"permalink":1513,"linkedin":1514},"Benjamin Dassow","people/people-benjamin-dassow.jpg","/authors/benjamin-dassow","benjamin-dassow",{"display_name":1516,"avatar":1517,"permalink":1518,"linkedin":1519},"Markus Walschburger","people/people-markus-walschburger.jpg","/authors/markus-walschburger","markus-walschburger",{"display_name":1521,"avatar":1522,"permalink":1523,"linkedin":1524,"imageOffsetTop":1280},"Jonathan Haist","people/people-jonathan-haist.jpg","/authors/jonathan-haist","jonathanhaist",{"display_name":1526,"avatar":1527,"permalink":1528,"linkedin":1529,"imageOffsetTop":1280},"Daniel Rohregger","people/people-daniel-rohregger.jpg","/authors/daniel-rohregger","drohregger",{"display_name":525,"avatar":1531,"permalink":1532,"linkedin":1533,"imageOffsetTop":1379},"people/people-thomas-naunheim.jpg","/authors/thomas-naunheim","thomasnaunheim",{"display_name":1535,"avatar":1536,"permalink":1537,"linkedin":1538,"imageOffsetTop":1379},"Florian Stöckl","people/people-florian-stoeckl.jpg","/authors/florian-stoeckl","florianstoeckl",{"display_name":1540,"avatar":1541,"permalink":1542,"linkedin":1543,"imageOffsetTop":1379},"Pascal Asch","people/Pascal.Asch.648.jpg","/authors/pascal-asch","pascal-asch",{"display_name":1545,"avatar":1546,"permalink":1547,"linkedin":1548,"imageOffsetTop":1549,"imageOffsetLeft":1550},"Markus Kättner","people/markus-kaettner.jpg","/authors/markus-kaettner","markus-kättner-b600119","62%","63%",{"display_name":1552,"avatar":1553,"permalink":1554,"linkedin":1555,"imageOffsetTop":1556,"imageOffsetLeft":1557},"Anna Ulbricht","people/anna-katharina.ulbricht-09.png","/authors/anna-ulbricht","anna-katharina-u-a67702199","70%","50%",{"display_name":1559,"avatar":1560,"permalink":1561,"linkedin":1562,"imageOffsetTop":1563,"imageOffsetLeft":1307},"Annette Brauns","people/Annette-Brauns-8.jpg","/authors/annette-brauns","annette-brauns","95%",{"Fritz Zurhorst":1565,"Alexander Schlindwein":1566,"Sophie Luna":1567,"Nadine Klein":1568,"Karsten Kleinschmidt":1569,"Julian Wendt":1570,"Holger Bunkradt":1571,"Ralf Mania":1572,"Oliver Kieselbach":1573,"Steffen Schwerdtfeger":1574,"Gunnar Winter":1575,"Jan Petersen":1576,"Thorsten Kunzi":1577,"Moritz Pohl":1578,"Thorben Pöschus":1579,"Christoph Hannebauer":1580,"Marco Scheel":1581,"Christopher Brumm":1582,"Florian Klante":1583,"Niklas Bachmann":1584,"Nils Krautkrämer":1585,"Patrick Treptau":1586,"Peter Beckendorf":1587,"Patrick Sobau":1588,"Jörg Wunderlich":1589,"Michael Breither":1590,"Christian Kanja":1591,"Zeba Hoffmann":1592,"Jochen Fröhlich":1593,"Jan Geisbauer":1594,"Gerrit Reinke":1598,"Christian Kordel":1599,"Stephan Wälde":1600,"Carolin Kanja":1601,"Adrian Ritter":1602,"Marvin Bangert":1603,"Thorsten Pickhan":1604,"Christian Lorenz":1605,"Denis Böhm":1606,"Fabian Bader":1607,"Juan Jose Fernandez Perez":1608,"Mahschid Sayyar":1609,"Benjamin Dassow":1610,"Markus Walschburger":1611,"Jonathan Haist":1612,"Daniel Rohregger":1613,"Thomas Naunheim":1614,"Florian Stöckl":1615,"Pascal Asch":1616,"Markus Kättner":1617,"Anna Ulbricht":1618,"Annette Brauns":1619},{"display_name":1276,"avatar":1277,"permalink":1278,"linkedin":1279,"imageOffsetTop":1280},{"display_name":1282,"avatar":1283,"permalink":1284,"twitter":1285,"linkedin":1286},{"display_name":1288,"avatar":1289,"permalink":1290,"twitter":1291,"linkedin":1292,"imageOffsetLeft":1293,"imageOffsetTop":1294},{"display_name":1296,"avatar":1297,"permalink":1298,"twitter":1299,"linkedin":1300,"imageOffsetTop":1280},{"display_name":1302,"avatar":1303,"permalink":1304,"twitter":1305,"linkedin":1306,"imageOffsetTop":1307,"imageOffsetLeft":1308},{"display_name":1310,"avatar":1311,"permalink":1312,"linkedin":1313},{"display_name":1315,"avatar":1316,"permalink":1317,"linkedin":1318,"twitter":1319},{"display_name":1321,"avatar":1322,"permalink":1323,"linkedin":1324,"twitter":1325},{"display_name":1327,"avatar":1328,"permalink":1329,"linkedin":1330,"twitter":1331},{"display_name":1333,"avatar":1334,"permalink":1335,"linkedin":1336,"twitter":1337,"imageOffsetTop":1338,"imageOffsetLeft":1339},{"display_name":1341,"avatar":1342,"permalink":1343,"twitter":1291,"linkedin":1344},{"display_name":1346,"avatar":1347,"permalink":1348,"twitter":1291,"linkedin":1349},{"display_name":1351,"avatar":1352,"permalink":1353,"twitter":1291,"linkedin":1344,"imageOffsetTop":1280},{"display_name":1355,"avatar":1356,"permalink":1357,"twitter":1291,"linkedin":1358},{"display_name":1360,"avatar":1361,"permalink":1362,"twitter":1363,"linkedin":1364},{"display_name":1366,"avatar":1367,"permalink":1368,"twitter":1291,"linkedin":1344,"imageOffsetTop":1280},{"display_name":1370,"avatar":1371,"permalink":1372,"twitter":1373,"linkedin":1373},{"display_name":524,"avatar":1375,"permalink":1376,"twitter":1377,"linkedin":1378,"imageOffsetTop":1379},{"display_name":1381,"avatar":1382,"permalink":1383,"linkedin":1384,"twitter":1291},{"display_name":1386,"avatar":1387,"permalink":1388,"linkedin":1389,"twitter":1291},{"display_name":1391,"avatar":1392,"permalink":1393,"twitter":1394,"linkedin":1395},{"display_name":1397,"avatar":1398,"permalink":1399,"linkedin":1400,"twitter":1291},{"display_name":1402,"avatar":1403,"permalink":1404,"linkedin":1405,"twitter":1291,"imageOffsetTop":1280},{"display_name":1407,"avatar":1408,"permalink":1409,"linkedin":1410,"twitter":1291},{"display_name":1412,"avatar":1413,"permalink":1414,"twitter":1291},{"display_name":1416,"avatar":1417,"permalink":1418,"twitter":1291,"linkedin":1419},{"display_name":1421,"avatar":1422,"permalink":1423,"twitter":1424,"linkedin":1425},{"display_name":1427,"avatar":1428,"permalink":1429,"linkedin":1430,"twitter":1291},{"display_name":1432,"avatar":1433,"permalink":1434,"twitter":1291,"linkedin":1344},{"display_name":1436,"avatar":1437,"permalink":1438,"twitter":1439,"linkedin":1439,"imageOffsetTop":1280,"socials":1595},[1596,1597],{"text":1442,"href":1443},{"text":1445,"href":1446},{"display_name":1448,"avatar":1449,"permalink":1450,"twitter":1451,"linkedin":1452},{"display_name":1454,"avatar":1455,"permalink":1456,"twitter":1291,"linkedin":1344},{"display_name":1458,"avatar":1459,"permalink":1460,"twitter":1461,"linkedin":1344},{"display_name":1463,"avatar":1464,"permalink":1465,"twitter":1466,"linkedin":1467},{"display_name":1469,"avatar":1470,"permalink":1471,"twitter":1472,"linkedin":1472},{"display_name":1474,"avatar":1475,"permalink":1476,"twitter":1477,"linkedin":1478},{"display_name":1480,"avatar":1481,"permalink":1482,"twitter":1483,"linkedin":1484},{"display_name":1486,"avatar":1487,"permalink":1488,"linkedin":1489,"twitter":1291},{"display_name":1491,"avatar":1492,"permalink":1493,"linkedin":1494,"twitter":1291},{"display_name":523,"avatar":1496,"permalink":1497,"linkedin":1498,"twitter":1499},{"display_name":1501,"avatar":1502,"permalink":1503,"linkedin":1504},{"display_name":1506,"avatar":1507,"permalink":1508,"linkedin":1509},{"display_name":1511,"avatar":1512,"permalink":1513,"linkedin":1514},{"display_name":1516,"avatar":1517,"permalink":1518,"linkedin":1519},{"display_name":1521,"avatar":1522,"permalink":1523,"linkedin":1524,"imageOffsetTop":1280},{"display_name":1526,"avatar":1527,"permalink":1528,"linkedin":1529,"imageOffsetTop":1280},{"display_name":525,"avatar":1531,"permalink":1532,"linkedin":1533,"imageOffsetTop":1379},{"display_name":1535,"avatar":1536,"permalink":1537,"linkedin":1538,"imageOffsetTop":1379},{"display_name":1540,"avatar":1541,"permalink":1542,"linkedin":1543,"imageOffsetTop":1379},{"display_name":1545,"avatar":1546,"permalink":1547,"linkedin":1548,"imageOffsetTop":1549,"imageOffsetLeft":1550},{"display_name":1552,"avatar":1553,"permalink":1554,"linkedin":1555,"imageOffsetTop":1556,"imageOffsetLeft":1557},{"display_name":1559,"avatar":1560,"permalink":1561,"linkedin":1562,"imageOffsetTop":1563,"imageOffsetLeft":1307},"Authors","1csawlkJxRljy93GTOnXEkwLqAv9Lcj-apxRvoodAOY",{"list":1623,"authors":1839},[1624,1641,1655,1669,1685,1698,1711,1724,1736,1752,1766,1781,1799,1810,1823],{"id":1625,"title":1626,"author":1627,"cta":494,"description":1172,"hideInRecent":484,"layout":1192,"meta":1628,"moment":1633,"path":1634,"stem":1635,"tags":1636,"webcast":484},"content_sv/posts/2026-09-22-end-of-mfa-sms.md","Slutet för MFA-SMS",[1302],{"lang":1194,"date":1629,"categories":1630,"blogtitlepic":1631,"customExcerpt":1632},"2026-09-21",[1199],"head-conditional-access.jpg","Varför företag nu bör gå över till phishingresistenta och så långt möjligt lösenordsfria inloggningsmetoder.","2026-09-22","/posts/2026-09-22-end-of-mfa-sms","posts/2026-09-22-end-of-mfa-sms",[1199,1637,1638,1639,1640],"Authentication","Microsoft Entra ID","MFA","Passkeys",{"id":1642,"title":1643,"author":1644,"cta":494,"description":1172,"hideInRecent":484,"layout":1192,"meta":1645,"moment":1629,"path":1649,"stem":1650,"tags":1651,"webcast":484},"content_sv/posts/2026-09-21-clickfix-prevent-detect.md","ClickFix. När användaren är exploiten, och hur ni stoppar det",[1276,1296],{"lang":1194,"date":1629,"categories":1646,"blogtitlepic":1647,"customExcerpt":1648},[1199],"head-clickfix.jpg","ClickFix gör användare till sin egen angripare: ett förfalskat CAPTCHA, en copy-paste, och skadlig kod körs i minnet utan att något landar på disken. Hur Microsoft Defender upptäcker attacken, var detekteringen når sina gränser och hur ni stänger luckan med en RunMRU-hunt och fyra skyddslager.","/posts/2026-09-21-clickfix-prevent-detect","posts/2026-09-21-clickfix-prevent-detect",[1652,1653,1654],"Defender","SOC","Endpoint Security",{"id":1656,"title":1657,"author":1658,"cta":494,"description":1172,"hideInRecent":484,"layout":1192,"meta":1659,"moment":1629,"path":1663,"stem":1664,"tags":1665,"webcast":484},"content_sv/posts/2026-09-21-red-tenant-dark-tenant-cio.md","Admin och vardag på samma dator? Game Over.",[1436],{"lang":1194,"date":1629,"categories":1660,"blogtitlepic":1661,"customExcerpt":1662},[1199],"head-game-over-en.jpg","Varför en tenant inte räcker för CIO:er, och varför den andra sällan tänks med. Managed Red Tenant separerar administrativt arbete arkitektoniskt från kontorsmiljön, Managed Dark Tenant håller företaget handlingskraftigt när försvaret ändå faller. Vad det betyder för driftmodell, SOC-signal och bevisplikterna enligt NISG 2026.","/posts/2026-09-21-red-tenant-dark-tenant-cio","posts/2026-09-21-red-tenant-dark-tenant-cio",[1199,1666,1667,1668],"Privileged Access","Zero Trust","NIS2",{"id":1670,"title":1671,"author":1672,"cta":494,"description":1673,"hideInRecent":484,"layout":1192,"meta":1674,"moment":1675,"path":1680,"stem":1681,"tags":1682,"webcast":484},"content_sv/posts/2026-08-08-isg-germany-2026.md","Fyra gånger Leader. glueckkanja i ISG-studien Tyskland 2026",[1463],"ISG har bytt namn på sin studie i år. Microsoft Cloud Ecosystem blev Microsoft AI and Cloud Ecosystem, och med namnet har måttstocken förskjutits: det som bedöms är inte längre vem som inför Microsoft-plattformar, utan vem som driver Copilot, agenter och AI-workloads kontrollerbart. På vår position har den nya måttstocken inte ändrat något. ISG Provider Lens®-studien Tyskland 2026 positionerar oss som Leader i fyra kvadranter: Microsoft Productivity and Business Process Services och Azure Managed Services, i både Large Market och Mid Market. Efter 2021, 2023, 2024 och 2025 är det den femte Leader-placeringen i Tyskland, i Schweiz kom steget in i Leader-kvadranten två veckor tidigare.",{"lang":1194,"date":1675,"categories":1676,"blogtitlepic":1678,"customExcerpt":1679},"2026-08-08",[1677],"Corporate","head-isg-de-2026.png","ISG Provider Lens®-studien 2026 positionerar glueckkanja i Tyskland som Leader i fyra kvadranter: Microsoft Productivity and Business Process Services och Azure Managed Services, i både Large och Mid Market. Studien heter nu Microsoft AI and Cloud Ecosystem, och måttstocken har förskjutits: det som bedöms är vem som driver AI- och agent-workloads kontrollerbart.","/posts/2026-08-08-isg-germany-2026","posts/2026-08-08-isg-germany-2026",[1683,1684],"Award","ISG",{"id":1686,"title":1687,"author":1688,"cta":494,"description":1689,"hideInRecent":484,"layout":1192,"meta":1690,"moment":1691,"path":1695,"stem":1696,"tags":1697,"webcast":484},"content_sv/posts/2026-07-31-isg-switzerland-2026.md","Från Rising Star till Leader. glueckkanja i ISG-studien Schweiz 2026",[1463],"2024 grundade vi glueckkanja Switzerland AG och flyttade in i ett kontor i zentroom på Bahnhofplatz 10b i Bern. 2025 placerade ISG oss som Rising Star på den schweiziska marknaden, som den leverantör som analytikerna tror kan ta steget in i Leader-kvadranten. Nu är steget dokumenterat: ISG Provider Lens®-studien 2026 positionerar oss i Schweiz som Leader i kvadranten Microsoft AI and Cloud Ecosystem, inom områdena Azure Managed Services och Microsoft Productivity and Business Process Services.",{"lang":1194,"date":1691,"categories":1692,"blogtitlepic":1693,"customExcerpt":1694},"2026-07-31",[1677],"head-isg-ch-2026.png","ISG Provider Lens®-studien 2026 positionerar glueckkanja i Schweiz som Leader i kvadranten Microsoft AI and Cloud Ecosystem, inom områdena Azure Managed Services och Microsoft Productivity and Business Process Services. Två år efter marknadsinträdet i Bern, ett år efter Rising Star-utmärkelsen.","/posts/2026-07-31-isg-switzerland-2026","posts/2026-07-31-isg-switzerland-2026",[1683,1684],{"id":1699,"title":1700,"author":1701,"cta":494,"description":1172,"hideInRecent":484,"layout":1192,"meta":1702,"moment":1703,"path":1707,"stem":1708,"tags":1709,"webcast":484},"content_sv/posts/2026-07-24-outbreak-openai-hugging-face.md","Outbreak. Vad OpenAI/Hugging-Face-incidenten avslöjar och vad den inte avslöjar",[1436],{"lang":1194,"date":1703,"categories":1704,"blogtitlepic":1705,"customExcerpt":1706},"2026-07-24",[1199],"head-outbreak.jpg","En AI-agent bryter sig ut ur sin testmiljö, hittar en zero-day och hackar ett annat företag. Låter som filmmanus, men hände faktiskt i juli 2026. Tid för en nykter placering: med lite psykologi, två security-veteraner och frågan om vad det betyder för ert försvar.","/posts/2026-07-24-outbreak-openai-hugging-face","posts/2026-07-24-outbreak-openai-hugging-face",[1710,1653,1667],"AI",{"id":1712,"title":1713,"author":1714,"cta":494,"description":1715,"hideInRecent":484,"layout":1192,"meta":1716,"moment":1717,"path":1721,"stem":1722,"tags":1723,"webcast":484},"content_sv/posts/2026-07-22-isg-cybersecurity-2026.md","Leader och Rising Star. glueckkanja i ISG:s cybersecurity-studie 2026",[1463],"Ny i kvadranten och direkt Leader: ISG Provider Lens®-studien \"Cybersecurity – Services and Solutions 2026\" positionerar glueckkanja som Leader inom Next-Gen SOC/MDR Services för medelstora företag i Tyskland. I totalmarknaden för Next-Gen SOC/MDR Services utser ISG oss till Rising Star, alltså den leverantör som analytikerna tror kan ta steget in i Leader-kvadranten inom de närmaste 12 till 24 månaderna.",{"lang":1194,"date":1717,"categories":1718,"blogtitlepic":1719,"customExcerpt":1720},"2026-07-22",[1677],"head-isg-cybersecurity-2026.png","ISG Provider Lens®-studien Cybersecurity 2026 utser glueckkanja till Leader i kvadranten Next-Gen SOC/MDR Services (Midmarket). I totalmarknaden för Next-Gen SOC/MDR Services är vi Rising Star. ISG intygar att vi har tillväxt över snittet, djup Microsoft-security-expertis och ett 24/7-SOC från Tyskland.","/posts/2026-07-22-isg-cybersecurity-2026","posts/2026-07-22-isg-cybersecurity-2026",[1683,1684,1199],{"id":1725,"title":1726,"author":1727,"cta":494,"description":1728,"hideInRecent":484,"layout":1192,"meta":1729,"moment":1730,"path":1733,"stem":1734,"tags":1735,"webcast":484},"content_sv/posts/2026-07-06-the-holy-trinity.md","The Holy Trinity: vad AI verkligen behöver för att arbeta",[1463],"Ett tillverkande företag vill veta vilka av dess 14 000 SKU:er som faktiskt är lönsamma. Svaret ligger i tre system som aldrig har utbytt en enda datapunkt med varandra. Fram till helt nyligen kostade det tre avdelningar, två veckor och en hel del god vilja att få fram det. Sedan början av 2026 kan en AI besvara den frågan på minuter: söka igenom data, upprätta samband, producera en rekommendation. Förutsatt att den har åtkomst.",{"lang":1194,"date":1730,"categories":1731,"blogtitlepic":1732},"2026-07-06",[131],"head-the-holy-trinity","/posts/2026-07-06-the-holy-trinity","posts/2026-07-06-the-holy-trinity",[1710,131],{"id":1737,"title":1738,"author":1739,"cta":494,"description":1740,"hideInRecent":484,"layout":1192,"meta":1741,"moment":1742,"path":1746,"stem":1747,"tags":1748,"webcast":484},"content_sv/posts/2026-07-01-onboarding-process.md","Kontraktet är påskrivet: så går din onboarding till hos oss",[1552],"Hur går egentligen er onboarding till? En fråga som möter oss gång på gång i samtal med sökande, för många har redan varit med om att en onboarding går knaggligt. Desto viktigare är det för oss att ge dig en bra känsla från början.",{"lang":1194,"date":1742,"categories":1743,"blogtitlepic":1744,"customExcerpt":1745},"2026-07-01",[1677],"Onboarding_Blogheader","Kontraktet är påskrivet, det första stora steget är taget. Men hur går det vidare nu? Vi tar med dig bakom kulisserna på vår onboarding, från preboarding till första veckan i teamet.","/posts/2026-07-01-onboarding-process","posts/2026-07-01-onboarding-process",[1749,1750,1751],"Employer Branding","Onboarding","Unternehmenskultur",{"id":1753,"title":1754,"author":1755,"cta":494,"description":1756,"hideInRecent":484,"layout":1192,"meta":1757,"moment":1758,"path":1762,"stem":1763,"tags":1764,"webcast":484},"content_sv/posts/2026-06-26-frontier-partner.md","Microsoft Frontier Partner: vi hör till",[1463],"I Microsofts partnerekosystem finns en hel rad erkännanden, och ändå skiljer sig Frontier Partner Badge i sin uppläggning från de övriga utmärkelserna. Den går inte att ansöka om, utan tilldelas på Microsofts initiativ till en exklusiv krets av partner som måste övertyga i flera discipliner parallellt, i stället för att briljera i en enda. Microsoft prövar därvid påvisad kompetens inom Cloud & AI Platforms, inom AI Business Solutions och inom Security på lika villkor, och vänder sig därmed till företag som inte uppfattar AI som ett påhäng på befintlig IT, utan som resultatet av en genomgående arkitektur som bär från identiteten via endpointen ända in i produktiv AI-drift.",{"lang":1194,"date":1758,"categories":1759,"blogtitlepic":1760,"customExcerpt":1761},"2026-06-26",[1677],"head-frontier-partner-badge.jpg","Sedan en tid tillbaka finns det en ny topputmärkelse i Microsoft AI Cloud Partner Program, Frontier Partner Badge. Microsoft tilldelar den uteslutande till en exklusiv krets av partner världen över som levererar bärkraftiga AI-projekt på hela Microsoft-stacken, från arbetsplatsen via molnplattformen och security ända in i själva AI-tillämpningen, och som har bevisat den ambitionen i praktiken. I DACH-området räknar den här gruppen bara en handfull företag, och vi är ett av dem.","/posts/2026-06-26-frontier-partner","posts/2026-06-26-frontier-partner",[1683,1765,1710],"Microsoft Partner",{"id":1767,"title":1768,"author":1769,"cta":494,"description":1770,"hideInRecent":484,"layout":1192,"meta":1771,"moment":1772,"path":1776,"stem":1777,"tags":1778,"webcast":484},"content_sv/posts/2026-06-09-vair-run.md","160 kilometer för ett gott ändamål",[1559],"Söndag morgon, klockan 8:30, Holbeinsteg vid Main. Elva kollegor i enhetliga NinjaCat-tröjor, redo för Frankfurter Runden. Regn, blixt och åska inkluderat. Att springa för ett gott ändamål var motivation nog för att snöra på löparskorna trots det dåliga vädret.",{"lang":1194,"date":1772,"categories":1773,"blogtitlepic":1774,"customExcerpt":1775},"2026-06-08",[1677],"frankfurter-runden.png","Elva kollegor, 16 varv, 160 kilometer, ett åskoväder och en pallplats: glueckkanja var med på Frankfurter Runden 2026 och skänkte pengar till VAIR e.V. för varje sprunget varv. Föreningen bygger en inkluderande sport- och kulturpark i Offenbach.","/posts/2026-06-09-vair-run","posts/2026-06-09-vair-run",[1779,1749,1780],"Top Arbeitgeber","Soziales Engagement",{"id":1782,"title":1783,"author":1784,"cta":494,"description":1785,"hideInRecent":484,"layout":1192,"meta":1786,"moment":1787,"path":1791,"stem":1792,"tags":1793,"webcast":484},"content_sv/posts/2026-04-10-incident-to-intelligence.md","Anatomin hos en okänd AMOS Stealer: Från larm till immunitet på timmar",[1540],"När ett larm utlöses i vårt SOC börjar klockan ticka: inte bara för den drabbade kunden, utan för alla organisationer under vårt skydd. Det farligaste ögonblicket i dagens hotlandskap är the Intelligence Gap, tidsfönstret mellan den första användningen av en ny malware-variant och den dag branschen får kännedom om den.",{"lang":1194,"date":1787,"categories":1788,"blogtitlepic":1789,"customExcerpt":1790},"2026-04-10",[1199],"head-amos-stealer.png","En hittills odokumenterad AMOS-Stealer-variant komprometterade en macOS-endpoint. Inga kända hashvärden, inga C2-data i offentliga databaser. Vårt SOC monterade ner sex obfuskeringslager, extraherade alla indikatorer och distribuerade skyddet till alla SOC-kunder inom timmar, innan branschen ens hade sett samplet.","/posts/2026-04-10-incident-to-intelligence","posts/2026-04-10-incident-to-intelligence",[1794,1795,1796,1797,1798],"Threat Intelligence","Incident Response","macOS Security","Malware Analysis","Cyber Security Operations Center",{"id":1800,"title":1801,"author":1802,"cta":494,"description":1803,"hideInRecent":484,"layout":1192,"meta":1804,"moment":1805,"path":1808,"stem":1809,"tags":494,"webcast":484},"content_sv/posts/2026-03-21-microsoft-edge-corporate-browser.md","Därför bör Edge vara er enda Corporate Browser",[1333],"Valet av webbläsare är i företagsmiljöer ett strategiskt beslut: det påverkar direkt hur mycket säkerhet och administrativ börda ni faktiskt har. Google Chrome var länge det närliggande alternativet, men Microsoft Edge har utvecklats till en webbläsare som griper direkt in i den befintliga stacken, framför allt när Microsoft 365 används och administrationen sker via Intune.",{"lang":1194,"date":1805,"blogtitlepic":1806,"customExcerpt":1807},"2026-03-21","head-microsoft-edge-default-browser.jpg","Inget företag har egentligen valt Chrome; den fanns bara där, med egen synklogik, egen kontohantering, eget policygränssnitt. Microsoft Edge däremot griper direkt in i den infrastruktur som ändå redan är igång: Entra ID, Intune, Defender. Det här inlägget visar hur bytet ser ut, hur Chrome via en Intune-policy omdirigeras till en landningssida och vad som faller bort när man slutar köra två webbläsare parallellt.","/posts/2026-03-21-microsoft-edge-corporate-browser","posts/2026-03-21-microsoft-edge-corporate-browser",{"id":1811,"title":1812,"author":1813,"cta":494,"description":1814,"hideInRecent":484,"layout":1192,"meta":1815,"moment":1816,"path":1820,"stem":1821,"tags":1822,"webcast":484},"content_sv/posts/2026-03-20-stryker-attack-intune-privilege.md","Ett adminkonto var allt som krävdes.",[1436],"Onsdag den 11 mars 2026. Medarbetare på Strykers kontor i 79 länder slog på sina datorer och fann dem tomma. Inloggningsskärmar ersatta med en logotyp. Företagsdatorer, tjänstemobiler, privata enheter som var registrerade i företagets BYOD-program – alla raderade samtidigt, över natten. Ingen ransomware, inga signaturer för skadlig kod, ingenting som ett endpoint-detection-verktyg hade kunnat upptäcka.",{"lang":1194,"date":1816,"categories":1817,"blogtitlepic":1818,"customExcerpt":1819},"2026-03-20",[1199],"head-stryker.jpg","Den 11 mars 2026 raderade Handala enheter i 79 länder, och allt som krävdes för det var ett komprometterat Intune-adminkonto. Ingen skadlig kod, ingen exploit, bara legitima hanteringsverktyg vända mot sina ägare. Vad som hände, varför det fungerade och vilka två arkitektoniska luckor som måste stängas.","/posts/2026-03-20-stryker-attack-intune-privilege","posts/2026-03-20-stryker-attack-intune-privilege",[71,1666,1667],{"id":1824,"title":1825,"author":1826,"cta":494,"description":1827,"hideInRecent":484,"layout":1192,"meta":1828,"moment":1829,"path":1833,"stem":1834,"tags":1835,"webcast":484},"content_sv/posts/2026-03-16-ai-agent-hackathon.md","Sex Agents. Fyra veckor. Skarp drift.",[1463],"Hur många timmar per vecka lägger er IT-avdelning på uppgifter som en agent skulle kunna klara på minuter?",{"lang":1194,"date":1829,"categories":1830,"blogtitlepic":1831,"customExcerpt":1832},"2026-03-16",[1677],"head-ai-agent-hackathon.jpg","Sex företag, fyra veckors byggfas, sex fungerande AI Agents – det var den första glueckkanja AI Agent Hackathon. Kiekert, Dr. Oetker, Eckes-Granini, igefa och lila logistik byggde i Copilot Studio agents som idag körs i produktion. Vad som blev resultatet och hur formatet fungerar.","/posts/2026-03-16-ai-agent-hackathon","posts/2026-03-16-ai-agent-hackathon",[1710,1836,1837,1838],"Copilot Studio","Hackathon","AI Agents",{"Karsten Kleinschmidt":1840,"Fritz Zurhorst":1841,"Nadine Klein":1842,"Jan Geisbauer":1843,"Carolin Kanja":1847,"Anna Ulbricht":1848,"Annette Brauns":1849,"Pascal Asch":1850,"Steffen Schwerdtfeger":1851},{"display_name":1302,"avatar":1303,"permalink":1304,"twitter":1305,"linkedin":1306,"imageOffsetTop":1307,"imageOffsetLeft":1308},{"display_name":1276,"avatar":1277,"permalink":1278,"linkedin":1279,"imageOffsetTop":1280},{"display_name":1296,"avatar":1297,"permalink":1298,"twitter":1299,"linkedin":1300,"imageOffsetTop":1280},{"display_name":1436,"avatar":1437,"permalink":1438,"twitter":1439,"linkedin":1439,"imageOffsetTop":1280,"socials":1844},[1845,1846],{"text":1442,"href":1443},{"text":1445,"href":1446},{"display_name":1463,"avatar":1464,"permalink":1465,"twitter":1466,"linkedin":1467},{"display_name":1552,"avatar":1553,"permalink":1554,"linkedin":1555,"imageOffsetTop":1556,"imageOffsetLeft":1557},{"display_name":1559,"avatar":1560,"permalink":1561,"linkedin":1562,"imageOffsetTop":1563,"imageOffsetLeft":1307},{"display_name":1540,"avatar":1541,"permalink":1542,"linkedin":1543,"imageOffsetTop":1379},{"display_name":1333,"avatar":1334,"permalink":1335,"linkedin":1336,"twitter":1337,"imageOffsetTop":1338,"imageOffsetLeft":1339},{"id":1271,"extension":1272,"meta":1853,"stem":8,"__hash__":1621},{"Christopher Brumm":1854,"Fabian Bader":1855,"Thomas Naunheim":1856},{"display_name":524,"avatar":1375,"permalink":1376,"twitter":1377,"linkedin":1378,"imageOffsetTop":1379},{"display_name":523,"avatar":1496,"permalink":1497,"linkedin":1498,"twitter":1499},{"display_name":525,"avatar":1531,"permalink":1532,"linkedin":1533,"imageOffsetTop":1379},1791383948887]