# iphase.dk

> Personal tech blog by Michael Mardahl, Microsoft MVP — Security, Identity & Access, Modern Work.

## Links
- [RSS Feed](https://iphase.dk/rss.xml)
- [Full content for LLMs](https://iphase.dk/llms-full.txt)

## Articles
- [Taking Back Control: Windows LAPS and Local Admin Management via Intune](https://iphase.dk/posts/intune/windows-laps-local-admin-control): A simple, opinionated guide to deploying Windows LAPS to cloud-native devices and reclaiming control of the local Administrators group using Intune.
- [The Outlook Issue That Wasn't Outlook: A NetScaler LAS Licensing War Story](https://iphase.dk/posts/misc/outlook-netscaler-las-license-drop): How an Outlook connectivity incident that looked like Exchange or TLS trouble turned out to be a NetScaler license drop after Citrix LAS migration.
- [Multi Admin Approval in Intune: Because One Admin Shouldn't Rule Them All](https://iphase.dk/posts/intune/intune-multi-admin-approval-access-policies): A practical guide to setting up Multi Admin Approval in Microsoft Intune — what it protects, how to configure it, how to harden it with Restricted Administrative Units, and why your future self will thank you for not letting a single compromised account nuke your tenant.
- [Autopilot Hybrid Entra Join via Entra Kerberos (Preview): The Fix We've Been Waiting For?](https://iphase.dk/posts/identity/autopilot-hybrid-entra-kerberos-preview): A complete guide to the new Entra Kerberos based Hybrid Join. Is it enough to save Hybrid Autopilot, or should we all just go Cloud Native?
- [The IT Admin's Guide to Horses: What Equines Can Teach Us About Enterprise Architecture](https://iphase.dk/posts/misc/the-it-admins-guide-to-horses): A lighthearted exploration of what horses and horsemanship can teach IT professionals about building resilient, scalable, and well-managed enterprise environments.
- [No VPN, No Internet: Building a Windows Firewall Kill Switch for FortiClient with Intune](https://iphase.dk/posts/intune/forticlient-vpn-kill-switch-windows-firewall-intune): How to prevent Windows 11 devices from accessing the internet when not connected to corporate VPN using Windows Firewall and Intune — and all the things that go wrong along the way.
- [Passkeys and the Personal Phone Problem – An MFA Update for 2026](https://iphase.dk/posts/identity/passkeys-personal-phone-mfa-update): An update on MFA in 2026: Microsoft's mandatory MFA enforcement, passkey types (synced vs device-bound), addressing personal phone resistance, and self-enrollment capabilities.
- [ConsentFix - The Quickfix](https://iphase.dk/posts/identity/consentfix-quickfix): How to protect your tenant from the ConsentFix OAuth attack by pre-creating and locking down service principals for vulnerable Microsoft first-party apps using PowerShell.
- [Unlocking Self-Service Account Recovery (SSAR) in Microsoft Entra](https://iphase.dk/posts/identity/self-service-account-recovery-ssar): A step-by-step guide to configuring Self-Service Account Recovery (SSAR) in Microsoft Entra ID, enabling users to regain access through government ID verification and biometric liveness checks.
- [Exporting Teams Chats: Why You Might Need It, and How I Built a Tool for It](https://iphase.dk/posts/misc/exporting-teams-chats-with-graph-api): A practical guide to exporting Microsoft Teams chat conversations using the Microsoft Graph API, including two authentication modes and real-world use cases.
- [2 for 1 - Mail Enable Unlicensed Admin Accounts - 2024 Edition](https://iphase.dk/posts/identity/2-for-1-admin-mail-enable-unlicensed-admin-accounts): How to save on Exchange Online licensing for admin accounts by using plus addressing or distribution list redirection to receive admin mail without purchasing additional licenses.
- [Simplify Windows Hello for Business SSO with Cloud Kerberos Trust - Part 1](https://iphase.dk/posts/identity/cloud-kerberos-trust-part-1): Part 1 of a trilogy exploring Cloud Kerberos Trust for Windows Hello for Business - covering concepts, trust model pain points, and why Cloud Kerberos Trust is the future of SSO to on-premises resources.
- [Simplify Windows Hello for Business SSO with Cloud Kerberos Trust - Part 2](https://iphase.dk/posts/identity/cloud-kerberos-trust-part-2): Part 2 of the Cloud Kerberos Trust trilogy - a step-by-step configuration walkthrough covering Entra Kerberos PowerShell setup, Intune Settings Catalog profile creation, and verification testing.
- [Simplify Windows Hello for Business SSO with Cloud Kerberos Trust - Part 3](https://iphase.dk/posts/identity/cloud-kerberos-trust-part-3): Part 3 of the Cloud Kerberos Trust trilogy - deep diving into the mechanics, migration from other trust models, NGC credentials, Wireshark captures, Kerberos ticket flows, and troubleshooting with klist.
- [2FA/MFA - Why Multi-Factor Authentication is Important](https://iphase.dk/posts/identity/why-multi-factor-authentication-is-important): A high-level overview of multi-factor authentication concepts, types (SMS, app-based, hardware), and why MFA is critical in today's corporate IT landscape.
- [Fix onmicrosoft.com Missing Default Domain](https://iphase.dk/posts/identity/onmicrosoft-com-missing-default-domain): A quick workaround to fix the missing onmicrosoft.com default domain alias on synced identities in hybrid Exchange environments by temporarily changing the user's UPN.
- [How to remove credentials from a FIDO2 key like a boss](https://iphase.dk/posts/identity/how-to-remove-credentials-from-a-fido2-key): Learn how to remove credentials from a FIDO2 key (Feitian keys specifically) and why housekeeping on your FIDO2 devices matters.
- [FSLogix slow sign-in (fix) redux - Black Screen bug](https://iphase.dk/posts/modernwork/fslogix-slow-sign-in-fix-redux): FSLogix slow sign-in caused by the App Readiness service can be fixed by resetting the bloated StateRepository database.
- [Managed Identities in Azure Automation (PowerShell)](https://iphase.dk/posts/azure/managed-identities-in-azure-automation-powershell): How to use Managed Identities in Azure Automation to securely access resources without credentials, including Microsoft Graph API access.
- [FSLogix slow sign-in (fix)](https://iphase.dk/posts/modernwork/fslogix-slow-sign-in-fix): How to fix FSLogix slow sign-in caused by a bloated notifications registry key on Windows Server Remote Desktop Session Hosts.
- [Securing SCEP/NDES for Intune with gMSA](https://iphase.dk/posts/intune/securing-scep-ndes-for-intune-with-gmsa): How to replace the NDES service account with a group managed service account (gMSA) to enhance security of your SCEP/NDES infrastructure for Intune.
- [Migrate BitLocker to Microsoft Entra ID](https://iphase.dk/posts/intune/migrate-bitlocker-to-azure-ad): How to migrate existing BitLocker recovery keys to Microsoft Entra ID using an Intune PowerShell script, without re-encrypting drives.
- [The Windows Hello Zone! - Part 2](https://iphase.dk/posts/identity/the-windows-hello-zone-part-2): Part 2 of the Windows Hello Zone series - why PINs are more secure than passwords and real-world scenarios where Windows Hello for Business prevents credential theft.
- [The Windows Hello Zone! - Part 1](https://iphase.dk/posts/identity/the-windows-hello-zone-part-1): Part 1 of the Windows Hello Zone series - real-world scenarios showing why biometric authentication with Windows Hello for Business is essential for enterprise security.
- [Enable Microsoft Enterprise SSO plug-in for Apple Devices through Intune](https://iphase.dk/posts/identity/enable-microsoft-enterprise-sso-plug-in-for-apple-devices-through-intune): How to enable the Microsoft Enterprise SSO plug-in for Apple iOS and macOS devices through Microsoft Intune.
- [Keeping Always On VPN - always on?](https://iphase.dk/posts/intune/keeping-always-on-vpn-always-on): Why Microsoft Always On VPN stops auto-connecting and how to fix it with Intune, including the AutoTriggerDisabledProfileList registry fix.
- [Managing Microsoft Teams Firewall requirements with Intune](https://iphase.dk/posts/intune/managing-microsoft-teams-firewall-requirements-with-intune): Deploy Windows Firewall rules for Microsoft Teams via Intune PowerShell scripts to silence the annoying Windows Security Alert for screen sharing.
- [Passwordless journey with FIDO2 - Part 3 - Engine troubles](https://iphase.dk/posts/identity/passwordless-journey-with-fido2-part-3-engine-troubles): Part 3 of the FIDO2 passwordless journey covering unsupported key whitelisting, AAGUID discovery, and reviews of Ensurity ThinC-AUTH, KEY-ID, and OnlyKey security keys.
- [Conditional Access and the woes of being an external user](https://iphase.dk/posts/identity/conditional-access-and-the-woes-of-being-an-external-user): Challenges of Conditional Access and MFA as an external/guest user in Entra ID tenants, and practical solutions including FIDO2 keys.
- [Passwordless journey with FIDO2 - Part 2 - Usage experiences](https://iphase.dk/posts/identity/passwordless-journey-with-fido2-part-2-usage-experiences): Part 2 of the FIDO2 passwordless journey covering hands-on usage experiences with Solokeys, Yubico, and eWBM biometric security keys for Azure AD.
- [Passwordless journey with FIDO2 - Part 1 - Getting started with Security keys](https://iphase.dk/posts/identity/passwordless-journey-with-fido2-part-1-getting-started-with-security-keys): Part 1 of the FIDO2 passwordless journey covering requirements, setup hurdles, and an overview of security key vendors for Azure AD enterprise use.
- [2 Cool new password policy features in Microsoft Entra Connect Sync](https://iphase.dk/posts/identity/2-cool-new-password-policy-features-in-azure-ad-connect): Two new Microsoft Entra Connect Sync preview features: force password reset at logon and enforce cloud password policy for synced users.
- [The Trouble with PEAP and Credential Guard](https://iphase.dk/posts/misc/the-trouble-with-peap-and-credential-guard): Why Windows 10 Credential Guard breaks PEAP (EAP-MSCHAPv2) authentication with Cisco ISE and RADIUS servers, and what to do about it.
- [Getting Off to a Good Start with Microsoft 365 Groups](https://iphase.dk/posts/modernwork/getting-off-to-a-good-start-with-microsoft-365-groups): Essential tips and best practices for organizations looking to adopt Microsoft 365 Groups including naming policies, email domains, access control and Teams integration.