Daniel Fraubaum
Lead Architect AI Endpoint & Security at baseIT
Vienna, Austria
Actions
Where cloud identity meets endpoint reality, minus the hype.
I'm Lead Architect AI Endpoint & Security at baseIT in Austria, with 15+ years in IT. I design and roll out Microsoft Entra, Intune, Windows 365 and Azure Virtual Desktop environments for enterprise customers, with identity-first security and automation at the core.
My sessions come straight out of customer projects: privileged access, workload and guest identities, Conditional Access, Global Secure Access and endpoint lifecycle. I show what actually ran in production, including the parts that broke along the way.
I build open source tools for Intune and Entra on GitHub and write about the field on headsinthecloud.blog.
Area of Expertise
Topics
Ephemeral PAW: The Privileged Workstation That Deletes Itself
Hardware-based Privileged Access Workstations remain the gold standard, with supply chain control, dedicated devices, and physical isolation. But not every organization can deploy PAW hardware across every scenario, and the ones that can rarely cover every admin who needs one. This is the design we landed on for the gaps.
Using Windows 365 Frontline in shared mode, every privileged session starts on a freshly provisioned Cloud PC and is destroyed on logoff. No persistent state, no leftover artifacts, no lateral movement from a compromised session. Internet access is locked down and connectivity to privileged resources runs through Global Secure Access, so the Cloud PC reaches exactly what it needs and nothing else.
We walk the full architecture as it was actually deployed: the Conditional Access policy set that gates access, the device filter that separates PAW sessions from the rest of the tenant, and the reprovisioning trigger that automates teardown. Live provisioning, a planted artifact that does not survive the rebuild, and a look at what the logs show when a session reaches for something outside its profile.
The parts that did not go smoothly get equal airtime. Where Frontline shared mode licensing forces design decisions you would not otherwise make, what breaks when admins expect persistence, and the failure modes worth knowing before Tier 0 goes anywhere near this. Plus the honest comparison against hardware PAWs, including the scenarios where the supply chain argument still wins and you should not use this at all.
For identity and endpoint architects who own privileged access and need something deployable for the cases hardware cannot cover.
Nobody Owns the Guests: Building Lifecycle Governance Entra ID Doesn't Give You
Entra ID Governance covers employees well. Lifecycle Workflows handle joiner, mover, and leaver. Entitlement Management runs access packages. Access Reviews keep permissions honest. For internal identities the story is close to complete.
Guests are a different matter. B2B collaboration grows in every organization, and the built in governance features leave real gaps for external identities. Accounts pile up after the project that needed them ended, access outlives its purpose, and ownership is unclear enough that cleanup never happens.
We start by mapping what actually exists, applied to guests in a live tenant, including the boundaries you hit and the scenarios that fall through. No slides claiming coverage the product does not deliver.
Then the solution built to close the gap: a Logic Apps based Guest User Lifecycle Management workflow handling invitation, periodic review, and cleanup. The running workflow, the Graph calls behind it, how sponsors are notified and what happens when they ignore the mail, and the guardrails that stop an automated deletion from removing the wrong account. It is on GitHub and deployable in your own tenant.
What it cost to get there is part of the session: where Logic Apps turned out to be the wrong tool, the Graph throttling behaviour that forced a redesign, the exclusion guard added after a near miss, and what still needs a human decision. For identity architects and IT professionals who own B2B collaboration and are tired of guest accounts nobody can account for.
Beyond Secrets: The Client Secret Your Admin Center Won't Show You
Your tenant is full of app registrations and service principals. Some you created, some a vendor created, some have been there since a migration nobody documented, and more and more of them now sit behind the AI agents and automations your teams are building. They authenticate, they hold Graph permissions, and most are secured with a client secret because that was the fastest path at the time.
This session goes after the uncomfortable part. A client secret can be added to a service principal through the Graph API and never appear in the Entra admin center. We do it live, look at the object from the portal and Graph side by side, and work out what your audit trail does and does not tell you afterwards.
Then we build the controls, in the order they were rolled out in real tenants. App Management Policies at tenant and per-application scope, with the same Graph call failing once the policy holds, plus the exclusion behaviour that decides whether it holds at all. Federated credentials and managed identities as the default for anything that can use them, and what you do for the vendor integrations that cannot. Conditional Access for Workload Identities as the layer controlling where a service principal may authenticate from.
Rollout experience included: what breaks when you enable App Management Policies in a tenant that has been running for years, how to find out what will break before it does, and the conversations with application owners that come with it. We close on detection, and which signals are actually worth alerting on.
For identity architects and security engineers who own an Entra tenant and want controls they can apply in production the same week, before the next wave of agents adds another hundred service principals.
Security Ninjas Germany 2026 Upcoming
Session: Beyond Secrets: Securing Workload Identities in Entra ID
App registrations and service principals are everywhere in your tenant, and most of them are secured worse than anyone likes to admit. This session covers client secrets on service principals that can be added via Graph but never show up in the Entra admin center, how App Management Policies block secret creation at tenant and app level, and how Conditional Access for Workload Identities controls how and from where non-human identities authenticate. Two live demos, straight from a real tenant.
techConference 2026
Workshop:
Zero Trust Reloaded: Entra Suite, Security Copilot & Modern Managed SOC in Practice
Deployment is only the starting gun for Zero Trust security, and that is exactly where we pick up. We show how the Microsoft Entra Suite closes governance gaps, how Global Secure Access gives you clear and controlled access paths, and how to keep workload identities properly under control. Security Copilot adds the pace, while our Managed SOC actively orchestrates the technologies behind the scenes. Hands-on, with live demos and concrete architecture recommendations you can take straight back to your environment.
Session:
Ephemeral PAW: Admin Access Without the Aftermath
Admin access is often already too insecure before anything even happens.
Too many access models still rest on outdated assumptions: the endpoint is trustworthy, the session stays manageable, and remote access becomes safe with enough policies layered on top. This session challenges exactly those assumptions. You will see a practical approach for enterprise admins to handle sensitive access in a controlled and isolated way, with no unnecessary persistence left behind. The focus is not product slides but real operational problems: access to corporate resources, hardened working sessions, and a clean handover that leaves no lingering residue. A session for everyone who wants to think about admin security in a way that actually holds up in operations.
techConference 2025
Workshop: Attack & Defense with Microsoft Entra. Understand Attack Patterns, Master Defense Strategies
This hands-on workshop dives into real-world identity attack scenarios targeting Microsoft Entra. We’ll explore common attack vectors such as token theft, privilege escalation, and misconfigured Conditional Access, and then walk through practical defense strategies to harden your environment. Expect live demos, actionable best practices, and guidance on building a resilient identity-first security posture.
Microsoft Discovery Day: Endpoint Innovation 2025
Talking about the newest Innovations from Windows in the Cloud and real live scenarios.
Please note that Sessionize is not responsible for the accuracy or validity of the data provided by speakers. If you suspect this profile to be fake or spam, please let us know.
Jump to top