Hello and welcome to the Monday, April 21st, 2025 edition of the Sands and then at Storm Center's

Stormcast. My name is Johannes Ulrich and today I'm recording from Jacksonville, Florida.

Looks like this weekend was not a good weekend for administrators using Microsoft Entra for authentication.

Microsoft apparently made life a new feature.

They're calling it Mace.

And the idea behind the feature is not a bad idea.

It does flag accounts whose credentials have been compromised in the past.

So they're tying into some kind of back end.

I'm not sure if it's have I been owned or something they built themselves.

But if you're using credentials that were found in recent compromises, the account is then

automatically locked.

The problem is that, well, a lot of accounts apparently were affected by this.

Some report, like about a third of their accounts were flagged, so you got this rash of alerts.

And of course, attackers haven't necessarily taken advantage of this issue, so it's very possible that the

account itself is still fine. It's a little bit tricky how you should react to these alerts.

Of course, you should probably ask users to update their passwords. But in the other hand,

having a third of your users all for a sudden disabled is often

not really sustainable from customer support as well as from a business perspective overall.

So you may need to find a quick workaround here to keep these accounts going for now.

It's not clear what exactly was compromised if just the password showed up in any compromise

of the username and password combination showed up.

Of course, the second being much more dangerous than your user is just using a somewhat weak

...