Correct. No policy is an adequate substitute for security training or phishing awareness training. That doesn’t mean to allow abuse cases though
export sensitive company data onto their own personal machines
Intune can be (and usually is) used to enforce logins only from enrolled devices. Personal devices can be enrolled, then Conditional Access policies can be applied to silo app data from company data, preventing this abuse case
reauth once per hour
No way. One per day, at most. No one should have to re-auth every hour, except maybe Global Admin accounts, which shouldn’t be used for day-to-day tasks anyway.
users who generate service account credentials
To do this in Entra, you need the Application Administrator role assigned, which is a Privileged Role, so it should be controlled by PAM to prevent/detect this abuse case.
When your policy teeters towards aggravating users, many of them will just find clever ways to circumvent it
Not for long. And usually not without leaving an audit trail that indicates violating acceptable use policies, security policies, or access control standards, which then becomes an HR issue, not an IT issue
Correct. No policy is an adequate substitute for security training or phishing awareness training. That doesn’t mean to allow abuse cases though
Intune can be (and usually is) used to enforce logins only from enrolled devices. Personal devices can be enrolled, then Conditional Access policies can be applied to silo app data from company data, preventing this abuse case
No way. One per day, at most. No one should have to re-auth every hour, except maybe Global Admin accounts, which shouldn’t be used for day-to-day tasks anyway.
To do this in Entra, you need the Application Administrator role assigned, which is a Privileged Role, so it should be controlled by PAM to prevent/detect this abuse case.
Not for long. And usually not without leaving an audit trail that indicates violating acceptable use policies, security policies, or access control standards, which then becomes an HR issue, not an IT issue