How Xbox Secures 70+ Entra Tenants Every Night with Maester
Summary
Meryl and Sam interview Audrey, a Principal Security Architect at Microsoft Gaming Studios, about using Maester to secure 70+ Entra ID tenants. They discuss adapting Microsoft’s security baseline for gaming studios, implementing custom tests via GitHub Actions, and managing multi-tenant compliance. The episode highlights automating drift detection, exception handling, and leveraging Maester for audit readiness and tenant consolidation strategies.
Topics discussed
Introduction and guest welcome
Audrey's background in Xbox and Azure security
Origin story: Scaling security across 70 tenants
Why Maester was chosen for baseline grading
Differences between Microsoft and Gaming baselines
Xbox security scope vs. Azure platform security
Evolution of Maester and custom test creation
Governance process and exception handling workflow
MFA rollout and custom dashboard creation
Integration with GitHub Actions and ticketing systems
GRC integration and the value of deep links
Educating teams on security risks and remediation
Extending Maester with custom scripts and permissions
Community contributions and AI-assisted test writing
Configuration drift detection and CI/CD for identity
Multi-tenant observability and audit facilitation
The 'Investigate' feature for quarterly reviews
Tenant sprawl and consolidation strategies
Personal chat: Vinyl records and Michael Jackson
Advice on using AI for PowerShell and DevOps
Listen ad-free on Castria