Remote

Merill Fernando

@merill@infosec.exchange

Product Manager @microsoft@infosec.exchange | entra.news CxP #identity #entra #graphpowershell
Dad • Dev • He/Him • 🇦🇺 • 🇱🇰 • Wurundjeri Country • Toots are my own. @merill@infosec.exchange on Twitter

1718 Followers

769 Following

50 Posts

Joined November 05, 2022

Website:

https://merill.net/about/

Twitter:

https://twitter.com/merill

LinkedIn:

https://www.linkedin.com/in/merill

GitHub:

https://github.com/merill

Profile:

He/Him

Newsletter:

https://entra.news

Posts

Merill Fernando

@merill@infosec.exchange · Aug 03, 2026

🚨 Entra Conditional Access gotcha from Andres Canello Selecting every device platform ≠ “Any device.” An attacker can spoof the browser user-agent, get no platform match, and that CA policy condition won’t apply. Watch Entra.Chat with for more nuggets 👇 https://entra.news/p/the-ultimate-microsoft-entra-global

0

0

0

0

Merill Fernando

@merill@infosec.exchange · Jul 29, 2026

Insider Risk Is a Business Decision - Bring HR In Early

0

0

0

0

Merill Fernando

@merill@infosec.exchange · Jul 29, 2026

🚧 Folks, we’re planning a major architecture change for Maester 3.0: a native test model with structured metadata, simpler contributions, centralized prerequisite handling, and compatibility for existing Pester tests. We want your feedback before finalizing the design 👇 https://github.com/maester365/maester/discussions/2050

RFC: A Maester-native test model for Maester 3.0 · maester365 maester · Discussion #2050

RFC: A Maester-native test model for Maester 3.0 Status: We have decided on the overall direction, but the design and migration experience are still open for community input. We are planning a sign...

0

0

0

0

Merill Fernando

@merill@infosec.exchange · Jul 28, 2026

Replying to @merill@infosec.exchange

Watch or listen: https://entra.news/p/why-entra-admins-need-microsoft-purview

1

0

0

0

Merill Fernando

@merill@infosec.exchange · Jul 28, 2026

Replying to @merill@infosec.exchange

If you work in Entra, this episode is an invitation to look over the fence and understand the security products and people you increasingly depend on. Ray is a Principal Security Consultant at Engage Squared and the author of Mastering Microsoft Purview Deployment in the Era of AI.

1

1

0

0

Merill Fernando

@merill@infosec.exchange · Jul 28, 2026

Replying to @merill@infosec.exchange

The conversation also went to some areas that are close to my heart. Ray shared the story of the charity he and his wife started in Nepal, and we spoke openly about burnout, layoffs, gratitude and building a career safety net outside any one employer.

1

2

0

0

Merill Fernando

@merill@infosec.exchange · Jul 28, 2026

Replying to @merill@infosec.exchange

→ Should the response be a block, an investigation or simply some education? → And what will the user actually experience? Ray made a great point: the technical configuration may take 15 minutes, but getting all the right teams aligned is the real work.

1

1

0

0

Merill Fernando

@merill@infosec.exchange · Jul 28, 2026

Replying to @merill@infosec.exchange

Ray had some really good tips for Entra admins. We don’t need to become Purview experts but we do need to understand enough of the neighbouring products to ask better questions. → What triggered this policy? → Who should own the alert?

1

4

0

0

Merill Fernando

@merill@infosec.exchange · Jul 28, 2026

Replying to @merill@infosec.exchange

Insider Risk can influence Conditional Access. Purview and Global Secure Access can help stop sensitive data moving into unsanctioned AI apps. A policy that looks simple in one portal can involve identity, network, data security, cybersecurity, HR, managers and data owners.

1

1

0

0

Merill Fernando

@merill@infosec.exchange · Jul 28, 2026

I’ll be honest. Purview has always felt like someone else’s part of the Microsoft security stack. I’m an Entra person. Ray Reyes isn’t, and that’s why I wanted him on Entra.Chat The lines between our products and teams are disappearing.

1

6

1

0

Merill Fernando

@merill@infosec.exchange · Jul 27, 2026

Replying to @merill@infosec.exchange

Plus a huge personal thank you from me to all the maester.cloud founding sponsors maester.cloud/founders who have helped me go full time on Maester. This release wouldn't have been possible without you. Learn all about this release at https://maester.dev/blog/maester-2-2

2

0

1

0

Merill Fernando

@merill@infosec.exchange · Jul 27, 2026

Replying to @merill@infosec.exchange

Simon Albers, Stephan van Rooij, Thomas Naunheim, Thomas Schmidt, Travis McDade, Truls Dahlsveen (PS Please let me know if I've missed anyone)

1

1

0

0

Merill Fernando

@merill@infosec.exchange · Jul 27, 2026

Replying to @merill@infosec.exchange

Huge thanks to our contributors Artem Borodai, Brian Reid, Christopher Brumm, Christopher Edwards, Fabian Bader, Henrik Piecha, Jan Bakker, Jean-Philippe George, Jon Gross, Jonathan Hope, Loïc Michel, Massimo Mazzariol, Matthias F., Mike Soule, Morten Mynster Kristensen, Ofir Gavish, Sam Erde,

0

1

0

0

Merill Fernando

@merill@infosec.exchange · Jul 27, 2026

Replying to @merill@infosec.exchange

🔥 Contributor credits across maester.dev, so the people writing these tests get the recognition they deserve

0

1

0

0

Merill Fernando

@merill@infosec.exchange · Jul 27, 2026

Replying to @merill@infosec.exchange

🔥 New Entra ID checks covering agent risk, directory sync safeguards, Conditional Access gaps, legacy MSOnline, and privileged first-party apps 🔥 A sharper report with markdown summaries, per-test durations, and critical findings sorted first

0

4

0

0

Merill Fernando

@merill@infosec.exchange · Jul 27, 2026

Replying to @merill@infosec.exchange

🔥 9 Global Secure Access checks for Private Access, forwarding profiles, Compliant Network, and Internet Access 🔥 4 Intune endpoint security checks for LAPS, attack surface reduction, App Control for Business, and Managed Installer

0

1

0

0

Merill Fernando

@merill@infosec.exchange · Jul 27, 2026

Replying to @merill@infosec.exchange

🔥 12 new SharePoint Online checks across the CIS and CISA baselines, now cross-platform with PnP.PowerShell 🔥 5 CIS GitHub organization controls and first-class GitHub connectivity

0

6

0

0

Merill Fernando

@merill@infosec.exchange · Jul 27, 2026

Replying to @merill@infosec.exchange

🔥 269 Active Directory checks across identity, policy, infrastructure, DNS, trusts, replication, and access control 🔥 5 Microsoft Purview checks to get your data security foundations ready for Copilot and AI

0

1

0

0

Merill Fernando

@merill@infosec.exchange · Jul 27, 2026

Replying to @merill@infosec.exchange

That includes Copilot config, Dataverse, SharePoint, Github (as more folks move agentic devlops to GitHub this is going to be super important), new Intune and Entra ID checks and so much more. Here are the highlights

0

1

0

0

Merill Fernando

@merill@infosec.exchange · Jul 27, 2026

Replying to @merill@infosec.exchange

We've added tests for so many new products (and sorry you need to sign in more times because not every Microsoft product uses Graph anymore 🤷‍♀️).

1

9

0

0

Merill Fernando

@merill@infosec.exchange · Jul 27, 2026

Replying to @merill@infosec.exchange

The biggest news is support for Active Directory is now in preview thanks to Mike Soule and we have some really cool plans for Active Directory with @PrzemyslawKlys and his awesome TestimoX AD suite. Stay tuned on this.

0

1

0

0

Merill Fernando

@merill@infosec.exchange · Jul 27, 2026

Folks, Maester 2.2 is here!! It was just a couple of months ago when we launched Maester 2.0 and the amazing Maester community has been SUPER busy.

2

11

2

0

Merill Fernando

@merill@infosec.exchange · Jul 26, 2026

We just sent out the latest Entra News for the week. Check it out! https://entra.news/p/entra-news-159-this-week-in-microsoft

0

1

0

0

Merill Fernando

@merill@infosec.exchange · Jul 25, 2026

Replying to @merill@infosec.exchange

BTW Fabian Bader had a great idea. Soon we'll be handing out exclusive badges/credentials to folks who contribute Maester tests.

0

0

0

0

Merill Fernando

@merill@infosec.exchange · Jul 25, 2026

Putting the final touches on the upcoming 🔥 Maester 2.2 release and look at this! A new Contributors page dedicated to the awesome community of folks that make Maester what it is today. Check it out and click through to the detail page of each author. maester.dev/contributors

0

1

1

0

Merill Fernando

@merill@infosec.exchange · Jul 25, 2026

👋 Check out this new Microsoft Entra blog post 👇 What's New in Microsoft Entra: July 2026 https://techcommunity.microsoft.com/t5/microsoft-entra-blog/what-s-new-in-microsoft-entra-july-2026/ba-p/4534631

0

0

0

0

Merill Fernando

@merill@infosec.exchange · Jul 24, 2026

👋 Check out this new Microsoft Entra blog post 👇 Modernize SAP Identity Management with Microsoft Entra https://techcommunity.microsoft.com/t5/microsoft-entra-blog/modernize-sap-identity-management-with-microsoft-entra/ba-p/4528596

0

0

0

0

Merill Fernando

@merill@infosec.exchange · Jul 22, 2026

👋 Check out this new Microsoft Entra blog post 👇 Microsoft Entra ID enhances security of branded sign-ins https://techcommunity.microsoft.com/t5/microsoft-entra-blog/microsoft-entra-id-enhances-security-of-branded-sign-ins/ba-p/4537471

0

0

0

0

Merill Fernando

@merill@infosec.exchange · Jul 21, 2026

👋 Check out this new Microsoft Entra blog post 👇 Secure AI, web, and private apps with Zero Trust https://techcommunity.microsoft.com/t5/microsoft-entra-blog/secure-ai-web-and-private-apps-with-zero-trust/ba-p/4516387

0

0

0

0

Merill Fernando

@merill@infosec.exchange · Jul 21, 2026

👋 Check out this new Microsoft Entra blog post 👇 Plan your Azure AD B2C migration with the Migration Policy Analyzer https://techcommunity.microsoft.com/t5/microsoft-entra-blog/plan-your-azure-ad-b2c-migration-with-the-migration-policy/ba-p/4532874

0

0

0

0

Merill Fernando

@merill@infosec.exchange · Jul 20, 2026

I was explaining how Microsoft Entra Staged Rollout works and realised it would make a great video especially the under-the-hood details that aren’t in the docs. A quick 7-minute walkthrough is coming soon. What would you like me to cover? 👇

0

0

0

0

Merill Fernando

@merill@infosec.exchange · Jul 20, 2026

Replying to @jerry@infosec.exchange

@jerry@infosec.exchange This is just step one, most AitM proxies know how to downgrade. We will only be secure once orgs go 100% phishing resistant.

0

0

0

0

Merill Fernando

@merill@infosec.exchange · Jul 19, 2026

Replying to @merill@infosec.exchange

Have questions on the SMS retirement and passkeys as default? I’ll be sitting down with the Microsoft Entra PM behind this change to get your questions answered. Post your questions here → https://entra.userjot.com/board/p/passkeys-by-default-sms-retired-it-s-happening-what-do-you 2/3

0

0

0

0

Merill Fernando

@merill@infosec.exchange · Jul 19, 2026

Huge Entra News this week. Microsoft announced plans to phase out SMS and Voice from Entra and passkeys becoming the default. 1/3

0

2

0

0

Merill Fernando

@merill@infosec.exchange · Jul 16, 2026

👋 Check out this new Microsoft Entra blog post 👇 AI agents are everywhere. Are your access controls ready? https://techcommunity.microsoft.com/t5/microsoft-entra-blog/ai-agents-are-everywhere-are-your-access-controls-ready/ba-p/4531379

0

0

0

0

Merill Fernando

@merill@infosec.exchange · Jul 12, 2026

One compromised Agent ID blueprint can become a multitenant blast radius. That is the most important idea in my latest conversation with Katie Knowles, Senior Security Researcher at Datadog, about her three-part security analysis of Microsoft Entra Agent ID. Watch or listen: https://entra.chat

0

0

0

0

Merill Fernando

@merill@infosec.exchange · Jul 10, 2026

Me teaching Entra Workload ID Federation to Sol. Fable made the same mistake too. All those badly coded auth code is tripping up the LLMs. For reference this is the article I linked to https://devblogs.microsoft.com/identity/access-cloud-resources-across-tenants-without-secrets/

0

0

0

0

Merill Fernando

@merill@infosec.exchange · Jul 05, 2026

👋 We just sent out this week's Entra newsletter. Check it out at https://entra.news/p/entra-news-156-this-week-in-microsoft

0

0

0

0

Merill Fernando

@merill@infosec.exchange · Jun 28, 2026

👋 Folks "passkeys won't save you." Vince Smith, who leads Agent ID at Microsoft Entra, explains why: squeeze one end of the balloon (users) and attackers move to the other 👉 NHI + workloads. New Entra Chat 👇 https://entra.news/p/from-windows-core-to-leading-agent

0

0

0

0

Merill Fernando

@merill@infosec.exchange · May 09, 2026

Fabian Bader asked and here it is.

cybersecpods.com now has links to @pocketcasts and @OvercastFM

Now it's a one-click to add and follow new cyber security podcasts on you favourite podcast players...

2

0

0

0

Merill Fernando

@merill@infosec.exchange · May 08, 2026

👋 Check out this new Microsoft Entra blog post 👇

What's New in Microsoft Entra: May 2026

https://techcommunity.microsoft.com/t5/microsoft-entra-blog/what-s-new-in-microsoft-entra-may-2026/ba-p/4517884

1

0

0

0

Merill Fernando

@merill@infosec.exchange · May 07, 2026

👋 Check out this new Microsoft Entra blog post 👇

Passkeys aren’t the finish line: Eliminating fallbacks and fixing recovery

https://techcommunity.microsoft.com/t5/microsoft-entra-blog/passkeys-aren-t-the-finish-line-eliminating-fallbacks-and-fixing/ba-p/3627345

3

0

0

0

Merill Fernando

@merill@infosec.exchange · May 06, 2026

Unboxing my new toy.

Qwen 3.6 here I come!

4

1

0

1

Merill Fernando

@merill@infosec.exchange · May 05, 2026

👋 Folks cybersecpods.com is live!

It's the home of cyber security podcasts, a place to explore and find podcasts for all of us in cyber.

It's open source and crowd sourced, if I'm missing any please add them.

2

0

1

0

Merill Fernando

@merill@infosec.exchange · May 04, 2026

👋 Check out this new Microsoft Entra blog post 👇

Build a secure identity foundation: 5 webinars to strengthen access management with Microsoft Entra

https://techcommunity.microsoft.com/t5/microsoft-entra-blog/build-a-secure-identity-foundation-5-webinars-to-strengthen/ba-p/4515965

2

0

0

0

Merill Fernando

@merill@infosec.exchange · May 04, 2026

👋 Here's a quick birds eye view of Microsoft Agent 365 licensing

Enjoy!

Disclaimer: I'm not a licensing person. Please refer to the official licensing FAQ for details https://www.microsoft.com/licensing/faqs/122

1

0

0

0

Merill Fernando

@merill@infosec.exchange · May 04, 2026

👋 Have you checked out this week's Entra.News?

Get the latest at https://entra.news/p/entra-news-147-this-week-in-microsoft

1

0

0

0

Merill Fernando

@merill@infosec.exchange · May 03, 2026

Replying to @vickyjo@mastodon.social

@vickyjo@mastodon.social @filippo@abyssdomain.expert Cheers. Tx Victoria. That's been my take as well. Synced passkeys are magical

1

0

0

0

Merill Fernando

@merill@infosec.exchange · May 02, 2026

New Entra Chat episode is out!

AI agents are being created across your tenant...

But who is checking if they are configured securely?

In this episode, Sam Erde and I dig into the Maester 2.1 release

🎙️ https://entra.news/p/how-to-secure-copilot-agents-azure

2

0

0

0

Merill Fernando

@merill@infosec.exchange · May 01, 2026

👋 Check out this new Microsoft Entra blog post 👇

Lock down AI, web, and private apps: what’s new in Internet Access and Private Access

https://techcommunity.microsoft.com/t5/microsoft-entra-blog/lock-down-ai-web-and-private-apps-what-s-new-in-internet-access/ba-p/3847825

1

0

0

0

Remote instance

infosec.exchange

Open on original server

Media