Security Credential Verification

Action required: Microsoft Entra ID SSPR will require registered authentication methods starting September 7, 2026! Currently, SSPR may allow users to verify their identity using contact information stored in directory attributes such as mobile phone, business phone, and alternate email, even if those values were never explicitly registered as authentication methods. To strengthen identity security, SSPR will require explicitly registered authentication methods for verification. This change is part of Microsoft's Secure Future Initiative and ensures password reset verification is based on trusted, user-validated methods rather than directory-sourced attributes. 𝗥𝗼𝗹𝗹𝗼𝘂𝘁 𝗦𝗰𝗵𝗲𝗱𝘂𝗹𝗲: • August 6, 2026: SSPR registration campaign begins prompting users and administrators to register authentication methods if SSPR setting requires registration and users do not have enough methods. • September 7, 2026: Enforcement begins. SSPR will no longer accept directory-sourced contact information for verification. • General Availability (Worldwide, GCC, GCC High): Early September 2026 through mid-September 2026. 𝗪𝗵𝗼 𝗶𝘀 𝗮𝗳𝗳𝗲𝗰𝘁𝗲𝗱: • All users (including administrators) in tenants with SSPR enabled. • Applies to Public cloud and US Government clouds (GCC, GCC High, DoD). 𝗣𝗹𝗮𝘁𝗳𝗼𝗿𝗺𝘀/𝗦𝗲𝗿𝘃𝗶𝗰𝗲𝘀: • Microsoft Entra ID. • Self-Service Password Reset (SSPR). • Web and admin portal experiences. 𝗪𝗵𝗮𝘁 𝘄𝗶𝗹𝗹 𝗵𝗮𝗽𝗽𝗲𝗻: • Only explicitly registered authentication methods will be accepted for SSPR verification. • Directory attributes (such as mobilePhone, businessPhone, otherMails) will no longer be valid unless registered. • Approximately 86% of SSPR verifications already use registered methods today. • Users without registered methods at enforcement will be:    • Unable to complete password resets.    • Prompted to register methods or contact an administrator. • The registration campaign will proactively prompt affected users starting August 6, 2026. 𝗔𝗰𝘁𝗶𝗼𝗻 𝗶𝘀 𝗿𝗲𝗾𝘂𝗶𝗿𝗲𝗱 𝗯𝗲𝗳𝗼𝗿𝗲 𝗦𝗲𝗽𝘁𝗲𝗺𝗯𝗲𝗿 𝟳, 𝟮𝟬𝟮𝟲: • Review authentication method registration coverage:    • Go to Microsoft Entra admin center → Authentication methods → User registration details. • Ensure all users (including admins) have at least one registered authentication method that satisfies your SSPR policy. • Allow or enable the SSPR registration campaign to prompt users automatically. • Plan fallback processes:    • Helpdesk-assisted registration.    • Alternative onboarding scenarios for users unable to self-register. • Communicate this change to:    • IT admins and helpdesk teams.    • Users (encourage registration via My Security Info). #Microsoft365 #EntraID #Cybersecurity #IAM

Authentication Methods — A QA Perspective As QA engineers, our role is not just to verify functionality but to validate security, reliability, and edge cases in API authentication. It’s not about which method is “best” — it’s about testing whether the chosen method fits the use case and is implemented correctly. 1) API Keys ✔️ Verify key presence, validity, and scope ✔️ Test for exposure risks (logs, URLs, headers) ✔️ Check rate limiting and unauthorized access scenarios 2) Basic Authentication ✔️ Ensure credentials are always sent over HTTPS ✔️ Test invalid/expired credentials ✔️ Validate proper error handling for unauthorized requests 3) Bearer Tokens ✔️ Test token expiry and refresh behavior ✔️ Validate access with valid vs invalid tokens ✔️ Check misuse scenarios (replay attacks, token leakage) 4) JSON Web Tokens (JWTs) ✔️ Verify token signature and claims (exp, roles, user data) ✔️ Test tampered tokens and invalid signatures ✔️ Validate behavior after token expiration 5) OAuth 2.0 ✔️ Test different flows (Authorization Code, Client Credentials, etc.) ✔️ Validate scope-based access control ✔️ Check token exchange and refresh mechanisms 6) OpenID Connect (OIDC) ✔️ Verify user identity via ID tokens ✔️ Validate claims like user info and authentication time ✔️ Ensure proper integration with OAuth flows 7) HMAC Authentication ✔️ Validate request signature generation ✔️ Test altered payloads to ensure integrity checks fail ✔️ Check timestamp/nonce to prevent replay attacks 8) Mutual TLS (mTLS) ✔️ Verify client certificate validation ✔️ Test handshake failures and invalid certificates ✔️ Ensure secure communication in service-to-service calls Each authentication method solves a different problem — identity, authorization, integrity, or trust. As testers, our job is to break assumptions, test boundaries, and ensure security holds under real-world scenarios.

[Entra Verified ID] Native Verified ID within #Entra could be a gamechanger when integrated with already native things like Conditional access & Identity Governance Access Packages allowing for verification of users. Consider also integrating with Service Desk flows so Service Desk operators can be confident in whom they are interacting with. Entra Verified ID takes absolute seconds to spin up on your Entra ID Tenant on your domain if you chose the #microsoft managed setup, it will host the keys in a microsoft managed keyvault taking away admin overhead. Some Notes: > Users may have super old pictures (or cartoons) in Entra ID, meaning when they onboard their Entra verified credential the face check may fail when its time for the check > The Face Check is also a liveness check for higher confidence its a real human, the screen will flicker with various brightness to attempt to sus out deepfakes. > When searching a user for revoking a credential the field is Case sensitive!!!!! > The DID will be published so anyone can recon that you have decentralized ID (DiD) in place, and it will show "https://verifiedid[.]entra[.]microsoft[.]com/:<Tenant ID>" if you did it via the microsoft managed option > If you used the advance settings for Entra Verified ID the DID will be need to be published at <domain>/.well-known/did.json, similiar to how #OIDC well-known endpoint works > Face Check in Access Packages requires Entra ID Goverance/Entra Suite > You get 8 free facechecks per license with Entra ID Suite and these are pooled together (so 100 licenses = 800 checks) > Face Checks otherwise cost $0.25 per check > If you start the advanced wizard and need to back out you will need to do a full reset from Verified ID > organization settings > If you delete the entire credential, it will NOT autodelete from the user's authenticator and it will NOT be deleted from Access Packages policy (so be very sure before you hit this button), users will be unable to request an access package and receive the error "You'll need to add this Verified ID". > The #Azure subscription for face check must be registered for Microsoft.VerifiedId (From Azure head to subscriptions > Resource Providers > find Microsoft.VerifiedId and enable) > The Claim for Photo in EntraID is "photo" > The Picture is part of the verified ID, when you open the ID its at the bottom and not on the card itself. With the picture living on authenticator it means a change in Entra ID cannot tamper with a picture on an already issued ID. You will need to issue another Verified ID to get the new picture. > A user can have multiple Verified IDs from the same domain. (I will provide a demo in comments courtesy of 🛡️ Philip Marsh) Entra Verified ID in conditional access isn't available yet but it was teased on a #Microsoft Mechanics Video on Youtube. I really hope it comes to PIM as well! #VerifyExplictly #Identity #ConditionalAccess #Security

I just walked in from a coffee with Kraken Digital Asset Exchange's sanctions lead Crystal Noe and see this! According to an excellent blogpost today, Kraken's security and recruitment teams recently uncovered and thwarted an attempted infiltration by a North Korean state-sponsored hacker—disguised as a job applicant. The incident, which began as a routine interview for an engineering position, quickly escalated into a high-stakes security operation and offers important lessons for the broader crypto and fintech ecosystem. The hacker raised immediate red flags: they joined their interview using a name different from the one listed on their resume and appeared to be coached in real time, switching voices mid-call. Kraken had already received intelligence from industry partners that North Korean actors were actively applying to jobs at crypto firms using networks of false identities. One of the flagged emails matched that of this candidate. Kraken’s red team initiated a deeper investigation, using open-source intelligence (OSINT) tools to identify ties between the applicant and other known aliases across GitHub, breached credential databases, and company systems. The candidate’s technical footprint—use of colocated remote desktops with a VPN and a doctored government-issued ID—added further weight to the suspicion. As the evidence mounted, Kraken advanced the applicant through its hiring funnel—not to recruit, but to study. The final interview, with Kraken’s CSO Nicholas Percoco and others, was a masterclass in subtle operational security. While asking standard technical questions, the team embedded “live” verification challenges—asking the candidate to hold up a government ID, confirm their physical location, and name local landmarks or restaurants. The hacker stumbled on basic geography and could not complete the two-factor authentication steps. By the interview’s end, the team had full confidence this was not just a suspicious candidate but a North Korean agent attempting to gain privileged access through the front door. Key Takeaways? ✔️Don't Trust, Verify—Every Step of the Way ✔️Use OSINT to Investigate Anomalies ✔️Incorporate Real-Time Identity Challenges ✔️Train Your Entire Organization, Not Just Security ✔️Leverage Industry Intel ✔️Recognize State-Sponsored Threats Are a Reality Kraken’s experience is a reminder that modern cybersecurity is no longer just about perimeter defense. Sometimes, attackers try to walk through the front door—wearing a suit and carrying a resume. Resilience begins with awareness, collaboration, and the creativity to think like a threat actor before they reach your systems. Congratulations to Nick, CJ Rinaldi, Crystal Noe, Sarah W., and the excellent team at Kraken working to keep the ecosystem safe. 📄 Read the full post here: https://lnkd.in/eM6r_RNN

Dear IT Auditors, Cloud Security Auditing and IAM Review In today’s cloud-driven world, identity is everything. Firewalls and networks no longer define the perimeter, users, service accounts, and access keys do. That’s why auditing Identity and Access Management (IAM) has become one of the most critical parts of any cloud security review. It’s where the control framework either holds strong or quietly fails. 📌 Start with visibility You can’t protect what you can’t see. Most organizations operate across multiple cloud platforms: AWS, Azure, Google Cloud, each with its own IAM model. The first audit step is understanding the full landscape. Are all identities, human and non-human, accounted for? Are there service accounts or API keys no one remembers owning? Hidden identities are hidden risks. 📌 Enforce least privilege In the cloud, it’s easy to grant broad permissions “just to get things working.” But over time, those privileges pile up. Audit how effectively least privilege is enforced. Identify users or applications with unnecessary admin rights and confirm that temporary access is revoked once it’s no longer needed. 📌 Check MFA consistency Multi-factor authentication (MFA) should be non-negotiable. Verify that MFA is active for every user, including privileged accounts and third-party connections. Gaps here are often where attackers find their way in. 📌 Look closely at federated access and SSO Most organizations rely on single sign-on and federation to simplify user access. Audit whether those integrations are secure, tokens expire properly, and logs capture all authentication activity. A weak federation setup can turn one compromise into a full-blown breach. 📌 Review key and credential management API keys and tokens deserve the same protection as passwords. Audit how they’re stored, rotated, and monitored. Keys hardcoded into scripts or repositories are silent exposures waiting to be found. 📌 Don’t ignore monitoring and alerting IAM logs tell the real story of who accessed what, when, and how. Review whether identity logs are centralized, analyzed, and used to trigger alerts for privilege changes or suspicious login attempts. Strong IAM audits give leaders more than compliance, they deliver assurance that access is controlled, accountability is clear, and cloud security rests on solid ground. #CloudSecurity #IAM #CybersecurityAudit #ITAudit #AccessControl #InternalAudit #CloudGovernance #RiskManagement #AuditLeadership #CyberResilience #CyberVerge #CyberYard

500,000 to 700,000 cyberattacks. Every. Single. Day. That’s what the UAE is dealing with right now (article linked in comments), driven by geopolitical tension and turbocharged by AI. And here’s the part most people miss: These aren’t just “more attacks.” They’re better attacks. AI is making phishing faster, more convincing, and infinitely scalable—deepfakes, perfectly crafted emails, real-time impersonation. Now ask yourself: 👉 If phishing is getting exponentially better… 👉 Why are so many organizations still relying on phishable authentication? Passwords. OTPs. Push. Even “modern” approaches like Windows Hello often fall back to these same weak factors the moment something breaks. That fallback is the attack surface. The only real answer is simple (but uncomfortable): Phishing-resistant authentication has to be enforced everywhere. No exceptions. No fallback. That means passkeys. That means FIDO. That means credentials that cannot be replayed, proxied, or socially engineered. But there’s a second problem most teams ignore: How are those credentials issued in the first place? Because if your “identity verification” process is: • Knowledge-based questions • SMS verification • Helpdesk resets • “What’s your employee ID?” …you’ve already lost. Attackers don’t hack credentials. They social engineer the issuance process. So the real maturity model looks like this: 1️⃣ Enforce phishing-resistant authentication (no fallback) 2️⃣ Secure credential issuance with strong identity verification 3️⃣ Eliminate KBA and anything a human can be tricked into revealing We are entering a world where: AI scales attacks → phishing becomes invisible → identity becomes the perimeter

Passwords have conditioned us to accept friction, but passkeys demonstrate that we can do better. Since Ignite, we have been focused on scaling verification to simplify authentication while preventing remote phishing and facilitating more convenient high-assurance recovery. What’s new: 🔐 Synced passkeys: username-less, phishing-resistant, and seamless across devices. 🛡️ High-assurance account recovery verifies identity using trusted signals rather than weaker fallbacks. Why it matters: - Users experience a 3× higher success rate with passkeys compared to legacy methods (95% vs ~30%). - Passkeys are 14× faster than password + code-based MFA. - Designed to resist remote phishing—there are no shared secrets to steal. I’m especially grateful to the teams across Microsoft who have been sticking with this work for a long time. Your persistence through complexity, your willingness to solve hard problems together, and your long‑term commitment to raising bar are what made this milestone possible. Thank you for staying the course, pushing through countless iterations, and never losing sight of the impact this work creates for our customers. Powered by standards and collaboration, I extend my gratitude to the teams across FIDO Alliance, and members across OIF as well as DIF for advancing #passkeys and #verifiablecredentials. In addition, thank you to some of the leading ID Verification partners - Au10tix, Lexis Nexis and Idemia for coming together to enable high assurance verification without custom business contracts or technical implementations. This initiative thrives on ecosystem collaboration. 🤝Momentum since Ignite: Hundreds of companies are actively implementing these solutions, accelerating the transition to passwordless, verified identity at scale. If you are driving identity modernization, I would love to hear from you. What is the biggest blocker to adopting passkeys or high-assurance recovery in your environment, and what would help you make progress in days instead of weeks or months? Please check out this blog for further details: https://lnkd.in/gseJ2r-p cc: Sangeeta Ranjit, Scott Bingham, Hana Kim, Calvin Lui, Pamela Dingle, Robin Goldstein, Adam Steenwyk, Malgorzata Niczyporuk, Daniel Castro, Scott Pruessing, Frank Chiachiere, James Hwang, Debaprajna Bhattacharyya, Rohit Gulati, Micheal Dunn, Christer Ljung, Juan Camilo Ruiz, Inbar Cizer Kobrinsky, Tim Larson, Jas Suri, Merill Fernando, Fernando Perez, Urja Shah, Matt Morris, Logan Girvin, Sydney Morton, Vladimir Potiyevskiy, Preeti Krishna, Jiju George Thundathil, Preeti Rastogi, Mudassir Ali, Daniel Godbout, Vikram Anbazhagan, Sudarshan J., Ankur A., Laura Viarengo, Jarred B., Hang Cu, Alex Simons, Eric Sachs

𝗔𝗽𝗽𝗹𝗲 𝗪𝗮𝗹𝗹𝗲𝘁 𝗗𝗶𝗴𝗶𝘁𝗮𝗹 𝗣𝗮𝘀𝘀𝗽𝗼𝗿𝘁𝘀 𝗨𝗻𝗱𝗲𝗿 𝘁𝗵𝗲 𝗛𝗼𝗼𝗱 We've probably all seen the headlines saying “you can now store your passport in Apple Wallet.” But behind that simple message is a full identity-verification system built on hardware security, cryptographic attestation, and selective data sharing. In other words: this isn’t a photo of your passport. It’s Apple building identity rails Here’s what’s actually happening 👇 𝗛𝗼𝘄 𝗔𝗽𝗽𝗹𝗲’𝘀 𝗩𝗶𝗿𝘁𝘂𝗮𝗹 𝗣𝗮𝘀𝘀𝗽𝗼𝗿𝘁 𝗪𝗼𝗿𝗸𝘀 ▪️You scan the photo page of your passport ▪️The iPhone reads the NFC chip, pulling cryptographically signed data ▪️Apple runs liveness detection (movement + biometrics) ▪️The credential is encrypted and stored in Secure Enclave ▪️Every presentation event requires Face ID / Touch ID This creates a hardware-rooted identity credential, similar in spirit to how device PANs (DPANs) anchor wallet payments 𝗦𝗲𝗹𝗲𝗰𝘁𝗶𝘃𝗲 𝗗𝗮𝘁𝗮 𝗦𝗵𝗮𝗿𝗶𝗻𝗴 When you present the virtual passport: ▪️A verifier (TSA, airport terminal, etc.) requests specific fields ▪️Apple shows you exactly what they’re asking for ▪️You approve with biometrics ▪️Only the requested attributes are shared, not the full passport This is minimum necessary disclosure, built directly into Wallet 𝗪𝗵𝘆 𝗧𝗵𝗶𝘀 𝗜𝘀 𝗕𝗶𝗴𝗴𝗲𝗿 𝗧𝗵𝗮𝗻 “𝗣𝗮𝘀𝘀𝗽𝗼𝗿𝘁 𝗶𝗻 𝗮 𝗣𝗵𝗼𝗻𝗲” What Apple actually built is: ▪️A verified government-backed credential ▪️A hardware-secured container for identity ▪️A consent-driven sharing flow ▪️A standardized API for identity verification (ID Verifier) If payment tokenization solved “secure card reuse,” this solves secure identity reuse 𝗪𝗵𝗮𝘁 𝗧𝗵𝗶𝘀 𝗠𝗲𝗮𝗻𝘀 𝗳𝗼𝗿 𝗙𝗶𝗻𝗧𝗲𝗰𝗵𝘀, 𝗠𝗲𝗿𝗰𝗵𝗮𝗻𝘁𝘀, 𝗮𝗻𝗱 𝗧𝗿𝗮𝘃𝗲𝗹 𝗔𝗽𝗽𝘀 Identity is often the slowest part of onboarding, this system changes that Benefits: ▪️Faster KYC → request verified fields (age, citizenship) without a doc upload ▪️Lower synthetic identity risk → tied to a real passport + device biometrics ▪️Higher trust at account creation → no more weak front-door checks ▪️Seamless travel flows → identity + payment could live in the same place Think of it like network tokenization, but for identity instead of PANs 𝗧𝗵𝗲 𝗕𝗶𝗴 𝗣𝗶𝗰𝘁𝘂𝗿𝗲 Apple started with airports for one reason: It’s the safest way to launch a verified credential at scale But the real impact will be in apps and merchants: → Age verification → KYC replacement → Account trust scoring → Travel identity flows → Marketplace onboarding The same way Apple Pay reshaped the checkout layer, Apple’s virtual passport will reshape the identity layer Source: Apple 🔔 Follow Jason Heister for daily #Fintech and #Payments guides, technical breakdowns, and industry insights

I talk a lot about the value of digital ID credentials, but I don’t often go deeper into what makes them so secure and privacy-preserving. One of the core pieces is DIDs, a W3C standard. A DID is a unique identifier that resolves to a pair of cryptographic keys. When an organization issues a verifiable credential, it signs that credential with its private key. The organization's public key is discoverable via their DID, so anyone verifying the credential can independently confirm two things: 1) the credential was issued by the claimed issuer 2) the data hasn’t been tampered with As an analogy, you can think of a DID a bit like a URL. Just as a URL is a globally resolvable identifier for a website, a DID is a globally resolvable identifier that allows digital ID credentials to be cryptographically verified. This is the foundation that makes digital verifiable credentials trustworthy and interoperable, while still preserving user privacy.

🪪 Can you trust an exam result if you're not completely sure who took the exam? Automated identity verification has become a standard part of many online testing programs. But for high-stakes certifications, licensing exams, and compliance-driven assessments, automation alone may not be enough. Why? Because sophisticated fraud attempts, impersonation risks, and questionable identification documents often require context, judgment, and expertise that automated systems can't always provide. In our latest video, we explore the limitations of automated ID checks and why human-reviewed identity verification is becoming a critical component of modern assessment security. Watch to learn: 🔹 Where automated identity verification can fall short 🔹 How human review helps identify fraud and impersonation risks 🔹 Why defensible verification matters during audits and appeals 🔹 How organizations can strengthen trust in certification and licensing outcomes High-stakes decisions require high-confidence verification. When credentials carry real-world consequences, organizations need more than a confidence score—they need evidence they can stand behind. ▶️ Watch the video to learn how Integrity Advocate combines advanced technology with trained human reviewers to deliver stronger identity verification, reduce risk, and protect credential integrity. 📖 Read the full article: https://lnkd.in/epJnaUVq 🌐 Learn more about Integrity Advocate: https://lnkd.in/ev6hjDTQ #ExamSecurity #IdentityVerification #OnlineProctoring #CertificationTesting #Compliance #Credentialing #TestingIntegrity #IntegrityAdvocate #EdTech #AssessmentSecurity https://lnkd.in/ezMkaW36