Personal tech blog by Michael Mardahl, Microsoft MVP — Security, Identity & Access, Modern Work.https://iphase.dk/https://iphase.dk/posts/intune/windows-laps-local-admin-control/https://iphase.dk/posts/intune/windows-laps-local-admin-control/A simple, opinionated guide to deploying Windows LAPS to cloud-native devices and reclaiming control of the local Administrators group using Intune.Thu, 07 May 2026 00:00:00 GMTintuneintunelapssecurityentrawindowshttps://iphase.dk/posts/misc/outlook-netscaler-las-license-drop/https://iphase.dk/posts/misc/outlook-netscaler-las-license-drop/How an Outlook connectivity incident that looked like Exchange or TLS trouble turned out to be a NetScaler license drop after Citrix LAS migration.Wed, 06 May 2026 00:00:00 GMTmiscnetscalercitrix-adcexchangeoutlooktlslastroubleshootinghttps://iphase.dk/posts/intune/intune-multi-admin-approval-access-policies/https://iphase.dk/posts/intune/intune-multi-admin-approval-access-policies/A practical guide to setting up Multi Admin Approval in Microsoft Intune — what it protects, how to configure it, how to harden it with Restricted Administrative Units, and why your future self will thank you for not letting a single compromised account nuke your tenant.Sun, 29 Mar 2026 00:00:00 GMTintuneintunemulti-admin-approvalsecurityzero-trustaccess-policiesrestricted-administrative-unitsentra-idhttps://iphase.dk/posts/identity/autopilot-hybrid-entra-kerberos-preview/https://iphase.dk/posts/identity/autopilot-hybrid-entra-kerberos-preview/A complete guide to the new Entra Kerberos based Hybrid Join. Is it enough to save Hybrid Autopilot, or should we all just go Cloud Native?Sat, 21 Mar 2026 00:00:00 GMTidentityentra-idautopilothybrid-joinkerberoswindows-11windows-hellohttps://iphase.dk/posts/misc/the-it-admins-guide-to-horses/https://iphase.dk/posts/misc/the-it-admins-guide-to-horses/A lighthearted exploration of what horses and horsemanship can teach IT professionals about building resilient, scalable, and well-managed enterprise environments.Fri, 13 Mar 2026 00:00:00 GMTmischorsesenterprise-architecturehumoranalogiesit-admin-lifehttps://iphase.dk/posts/intune/forticlient-vpn-kill-switch-windows-firewall-intune/https://iphase.dk/posts/intune/forticlient-vpn-kill-switch-windows-firewall-intune/How to prevent Windows 11 devices from accessing the internet when not connected to corporate VPN using Windows Firewall and Intune — and all the things that go wrong along the way.Sun, 01 Mar 2026 00:00:00 GMTintuneintunevpnforticlientwindows-firewallkill-switchhttps://iphase.dk/posts/identity/passkeys-personal-phone-mfa-update/https://iphase.dk/posts/identity/passkeys-personal-phone-mfa-update/An update on MFA in 2026: Microsoft's mandatory MFA enforcement, passkey types (synced vs device-bound), addressing personal phone resistance, and self-enrollment capabilities.Sat, 10 Jan 2026 00:00:00 GMTidentityentra-idfido2mfamicrosoft-authenticatorpasskeypasswordlesszero-trusthttps://iphase.dk/posts/identity/consentfix-quickfix/https://iphase.dk/posts/identity/consentfix-quickfix/How to protect your tenant from the ConsentFix OAuth attack by pre-creating and locking down service principals for vulnerable Microsoft first-party apps using PowerShell.Thu, 08 Jan 2026 00:00:00 GMTidentityentra-idoauthsecuritypowershellservice-principalsconditional-accesshttps://iphase.dk/posts/identity/self-service-account-recovery-ssar/https://iphase.dk/posts/identity/self-service-account-recovery-ssar/A step-by-step guide to configuring Self-Service Account Recovery (SSAR) in Microsoft Entra ID, enabling users to regain access through government ID verification and biometric liveness checks.Tue, 30 Dec 2025 00:00:00 GMTidentityentra-idpasskeypasswordlessssarssprverified-idface-checkhttps://iphase.dk/posts/misc/exporting-teams-chats-with-graph-api/https://iphase.dk/posts/misc/exporting-teams-chats-with-graph-api/A practical guide to exporting Microsoft Teams chat conversations using the Microsoft Graph API, including two authentication modes and real-world use cases.Mon, 01 Sep 2025 00:00:00 GMTmiscteamsmicrosoft-graphpowershellexportautomationarchivinghttps://iphase.dk/posts/identity/2-for-1-admin-mail-enable-unlicensed-admin-accounts/https://iphase.dk/posts/identity/2-for-1-admin-mail-enable-unlicensed-admin-accounts/How to save on Exchange Online licensing for admin accounts by using plus addressing or distribution list redirection to receive admin mail without purchasing additional licenses.Fri, 02 Feb 2024 00:00:00 GMTidentityexchange-onlineadmin-accountslicensingpowershellplus-addressinghttps://iphase.dk/posts/identity/cloud-kerberos-trust-part-1/https://iphase.dk/posts/identity/cloud-kerberos-trust-part-1/Part 1 of a trilogy exploring Cloud Kerberos Trust for Windows Hello for Business - covering concepts, trust model pain points, and why Cloud Kerberos Trust is the future of SSO to on-premises resources.Sat, 04 Mar 2023 00:00:00 GMTidentitycloud-kerberos-trustssowindows-hello-for-businesspasswordlesskerberoshttps://iphase.dk/posts/identity/cloud-kerberos-trust-part-2/https://iphase.dk/posts/identity/cloud-kerberos-trust-part-2/Part 2 of the Cloud Kerberos Trust trilogy - a step-by-step configuration walkthrough covering Entra Kerberos PowerShell setup, Intune Settings Catalog profile creation, and verification testing.Sat, 04 Mar 2023 00:00:00 GMTidentitycloud-kerberos-trustssowindows-hello-for-businessintunepowershellhttps://iphase.dk/posts/identity/cloud-kerberos-trust-part-3/https://iphase.dk/posts/identity/cloud-kerberos-trust-part-3/Part 3 of the Cloud Kerberos Trust trilogy - deep diving into the mechanics, migration from other trust models, NGC credentials, Wireshark captures, Kerberos ticket flows, and troubleshooting with klist.Sat, 04 Mar 2023 00:00:00 GMTidentitycloud-kerberos-trustssowindows-hello-for-businesskerberosactive-directoryhttps://iphase.dk/posts/identity/why-multi-factor-authentication-is-important/https://iphase.dk/posts/identity/why-multi-factor-authentication-is-important/A high-level overview of multi-factor authentication concepts, types (SMS, app-based, hardware), and why MFA is critical in today's corporate IT landscape.Tue, 17 Jan 2023 00:00:00 GMTidentitymfamulti-factor-authenticationphishingsecuritypasswordlesshttps://iphase.dk/posts/identity/onmicrosoft-com-missing-default-domain/https://iphase.dk/posts/identity/onmicrosoft-com-missing-default-domain/A quick workaround to fix the missing onmicrosoft.com default domain alias on synced identities in hybrid Exchange environments by temporarily changing the user's UPN.Mon, 07 Mar 2022 00:00:00 GMTidentityexchange-onlinehybrid-identityonmicrosoft-comupnentra-connecttroubleshootinghttps://iphase.dk/posts/identity/how-to-remove-credentials-from-a-fido2-key/https://iphase.dk/posts/identity/how-to-remove-credentials-from-a-fido2-key/Learn how to remove credentials from a FIDO2 key (Feitian keys specifically) and why housekeeping on your FIDO2 devices matters.Tue, 25 Jan 2022 00:00:00 GMTidentityfido2security-keyspasswordlessfeitianhttps://iphase.dk/posts/modernwork/fslogix-slow-sign-in-fix-redux/https://iphase.dk/posts/modernwork/fslogix-slow-sign-in-fix-redux/FSLogix slow sign-in caused by the App Readiness service can be fixed by resetting the bloated StateRepository database.Mon, 30 Aug 2021 00:00:00 GMTmodernworkfslogixapp-readinessblack-screenslow-loginremote-desktophttps://iphase.dk/posts/azure/managed-identities-in-azure-automation-powershell/https://iphase.dk/posts/azure/managed-identities-in-azure-automation-powershell/How to use Managed Identities in Azure Automation to securely access resources without credentials, including Microsoft Graph API access.Fri, 02 Jul 2021 00:00:00 GMTazureazure-automationmanaged-identitypowershellmicrosoft-graphsecurityhttps://iphase.dk/posts/modernwork/fslogix-slow-sign-in-fix/https://iphase.dk/posts/modernwork/fslogix-slow-sign-in-fix/How to fix FSLogix slow sign-in caused by a bloated notifications registry key on Windows Server Remote Desktop Session Hosts.Thu, 17 Jun 2021 00:00:00 GMTmodernworkfslogixvdiremote-desktopslow-loginregistryhttps://iphase.dk/posts/intune/securing-scep-ndes-for-intune-with-gmsa/https://iphase.dk/posts/intune/securing-scep-ndes-for-intune-with-gmsa/How to replace the NDES service account with a group managed service account (gMSA) to enhance security of your SCEP/NDES infrastructure for Intune.Wed, 12 May 2021 00:00:00 GMTintunescepndesgmsacertificatesintunesecurityhttps://iphase.dk/posts/intune/migrate-bitlocker-to-azure-ad/https://iphase.dk/posts/intune/migrate-bitlocker-to-azure-ad/How to migrate existing BitLocker recovery keys to Microsoft Entra ID using an Intune PowerShell script, without re-encrypting drives.Tue, 12 Jan 2021 00:00:00 GMTintunebitlockerazure-admbamescrowpowershellmigrationhttps://iphase.dk/posts/identity/the-windows-hello-zone-part-2/https://iphase.dk/posts/identity/the-windows-hello-zone-part-2/Part 2 of the Windows Hello Zone series - why PINs are more secure than passwords and real-world scenarios where Windows Hello for Business prevents credential theft.Wed, 16 Dec 2020 00:00:00 GMTidentitywindows-hello-for-businesspasswordlesspin-loginendpoint-securityzero-trusthttps://iphase.dk/posts/identity/the-windows-hello-zone-part-1/https://iphase.dk/posts/identity/the-windows-hello-zone-part-1/Part 1 of the Windows Hello Zone series - real-world scenarios showing why biometric authentication with Windows Hello for Business is essential for enterprise security.Wed, 18 Nov 2020 00:00:00 GMTidentitywindows-hello-for-businessbiometric-loginpasswordlesshybrid-key-trustendpoint-securityhttps://iphase.dk/posts/identity/enable-microsoft-enterprise-sso-plug-in-for-apple-devices-through-intune/https://iphase.dk/posts/identity/enable-microsoft-enterprise-sso-plug-in-for-apple-devices-through-intune/How to enable the Microsoft Enterprise SSO plug-in for Apple iOS and macOS devices through Microsoft Intune.Wed, 14 Oct 2020 00:00:00 GMTidentityauthenticatorssointuneappleiosmacoshttps://iphase.dk/posts/intune/keeping-always-on-vpn-always-on/https://iphase.dk/posts/intune/keeping-always-on-vpn-always-on/Why Microsoft Always On VPN stops auto-connecting and how to fix it with Intune, including the AutoTriggerDisabledProfileList registry fix.Wed, 29 Apr 2020 00:00:00 GMTintunealways-on-vpnconnectivityvpnintunehttps://iphase.dk/posts/intune/managing-microsoft-teams-firewall-requirements-with-intune/https://iphase.dk/posts/intune/managing-microsoft-teams-firewall-requirements-with-intune/Deploy Windows Firewall rules for Microsoft Teams via Intune PowerShell scripts to silence the annoying Windows Security Alert for screen sharing.Sun, 29 Mar 2020 00:00:00 GMTintuneintuneteamspowershellfirewallhttps://iphase.dk/posts/identity/passwordless-journey-with-fido2-part-3-engine-troubles/https://iphase.dk/posts/identity/passwordless-journey-with-fido2-part-3-engine-troubles/Part 3 of the FIDO2 passwordless journey covering unsupported key whitelisting, AAGUID discovery, and reviews of Ensurity ThinC-AUTH, KEY-ID, and OnlyKey security keys.Fri, 07 Feb 2020 00:00:00 GMTidentityfido2passwordlessmfasecurity-keysazure-adhttps://iphase.dk/posts/identity/conditional-access-and-the-woes-of-being-an-external-user/https://iphase.dk/posts/identity/conditional-access-and-the-woes-of-being-an-external-user/Challenges of Conditional Access and MFA as an external/guest user in Entra ID tenants, and practical solutions including FIDO2 keys.Sun, 19 Jan 2020 00:00:00 GMTidentityconditional-accessidentity-and-accessmicrosoft-authenticatorconsultantsmfahttps://iphase.dk/posts/identity/passwordless-journey-with-fido2-part-2-usage-experiences/https://iphase.dk/posts/identity/passwordless-journey-with-fido2-part-2-usage-experiences/Part 2 of the FIDO2 passwordless journey covering hands-on usage experiences with Solokeys, Yubico, and eWBM biometric security keys for Azure AD.Mon, 18 Nov 2019 00:00:00 GMTidentityfido2passwordlessssoyubicoyubikeyewbmsolokeyshttps://iphase.dk/posts/identity/passwordless-journey-with-fido2-part-1-getting-started-with-security-keys/https://iphase.dk/posts/identity/passwordless-journey-with-fido2-part-1-getting-started-with-security-keys/Part 1 of the FIDO2 passwordless journey covering requirements, setup hurdles, and an overview of security key vendors for Azure AD enterprise use.Mon, 28 Oct 2019 00:00:00 GMTidentityfido2passwordlesssecurity-keyyubicoewbmsolokeysazure-adhttps://iphase.dk/posts/identity/2-cool-new-password-policy-features-in-azure-ad-connect/https://iphase.dk/posts/identity/2-cool-new-password-policy-features-in-azure-ad-connect/Two new Microsoft Entra Connect Sync preview features: force password reset at logon and enforce cloud password policy for synced users.Mon, 07 Oct 2019 00:00:00 GMTidentityazure-ad-connectpassword-policyuser-accountsentra-idhttps://iphase.dk/posts/misc/the-trouble-with-peap-and-credential-guard/https://iphase.dk/posts/misc/the-trouble-with-peap-and-credential-guard/Why Windows 10 Credential Guard breaks PEAP (EAP-MSCHAPv2) authentication with Cisco ISE and RADIUS servers, and what to do about it.Sat, 14 Jul 2018 00:00:00 GMTmisccredential-guardwindows-10securitypeapcisco-isecertificateshttps://iphase.dk/posts/modernwork/getting-off-to-a-good-start-with-microsoft-365-groups/https://iphase.dk/posts/modernwork/getting-off-to-a-good-start-with-microsoft-365-groups/Essential tips and best practices for organizations looking to adopt Microsoft 365 Groups including naming policies, email domains, access control and Teams integration.Sat, 23 Dec 2017 00:00:00 GMTmodernworkoffice-365microsoft-365-groupsmicrosoft-teamscollaboration