Identity Architect
DirTeam
IT Infrastructure Specialist – MVP
Nextpert
Entra ID Applications: 5 Dos & Don’ts to Protect Your Blind Spot
This presentation by Sander Berkauer and Raymond Convalius focuses on application security in Microsoft Entra ID and the modern workplace.
The speakers explain how Entra ID applications work, distinguishing between app registrations and enterprise applications, and emphasizing that everything is becoming an app-based identity. They cover the differences between delegated permissions and app-only permissions, highlighting security risks from misconfigurations.
The session includes real-world examples of breaches, including a municipality losing €600,000 due to improper application permissions. Key topics include: credential hygiene, user consent settings, admin consent workflows, and the importance of reviewing application permissions regularly.
The speakers provide practical recommendations for securing applications without requiring expensive E5 licenses, emphasizing proper governance, monitoring of privileged roles like cloud app administrators, and the need to treat applications as part of identity and access management processes.
February 27, 2026
See Other Session
Hybrid cloud security
Through live demos, Microsoft MVP Christopher Brumm shows how you can implement granular access controls, privileged identity management, and access packages for partners and consultants, while maintaining high security standards.
Hybrid cloud security
In this HIP Conf session, Tim Wolf, Senior Solution Architect at Semperis, discusses the challenges of traditional PAW implementations and explores how modern PAW approaches offer greater flexibility and easier management while maintaining Zero Trust principles.
Hybrid cloud security, Identity threat detection and response
Token theft attacks—which enable attackers to impersonate users even in environments with strong authentication—are on the rise. Fortunately, Entra ID has built-in protections. Discover how to use them, how threat actors also leverage them, and how to detect such abuse.
Active Directory security, Hybrid cloud security
True: You can’t get rid of NTLM in 30 minutes. The entire process typically takes months or even years. But in 30 minutes, you can learn invaluable tips for removing NTLM quickly but precisely. Get the method and toolkit in this HIP Conf session.
Hybrid cloud security
Microsoft Security expert and MVP Ru Campbell has worked across hundreds of Microsoft 365 and Entra ID tenants while building a multi-tenant cloud security posture management (CSPM) platform. This session distills practical lessons from that experience. Leave with a focused, immediately actionable set of high-impact security changes that you can apply to your own tenants.
Active Directory security
Active Directory expert Christoffer Andersson delivers an in-depth technical presentation and practical security demonstration on the internal workings of Active Directory, clarifying common misconceptions and demonstrating advanced troubleshooting techniques.
Hybrid cloud security
Privileged Identity Management is key in a Zero Trust environment, but it’s not a plug-and-play solution. In this session, learn how to avoid common pitfalls and how administrators can unlock the full potential of PIM. Leave with best practices to enhance control and security in your daily operations.
Hybrid cloud security
Non-human workload identities involve a crucial human element: knowing how to securely configure and monitor them. In this session, Eric Woodruff, Chief Identity Architect at Semperis, and Thomas Naunheim, Cyber Security Architect, glueckkanja AG, explore workload identities and credential options for integrating your workloads with Entra ID.
Hybrid cloud security
Hybrid identity environments often turn into a patchwork of cloud and on-prem systems—breeding access chaos, privilege creep, and compliance risk. In this session, discover how Microsoft Entra ID Governance can bring unified control to mixed environments. Learn how to automate joiner-mover-leaver processes, enforce least privilege, and restore visibility and order across both worlds.
Sign Up for Email Updates