Azure AD: identity attacks & defense
Understanding Azure AD
Definition
Azure AD — Microsoft's cloud-based identity and access management platform, now rebranded as Microsoft Entra ID — is the authentication backbone for Microsoft 365, Azure resources, and thousands of third-party SaaS applications. Azure AD handles identity attacks and defense scenarios that are fundamentally different from on-premises Active Directory. It relies on modern protocols: OAuth 2.0, OpenID Connect, and SAML. Identities are organized into tenants, with users, service principals, managed identities, and application registrations as core objects. Privileged roles such as Global Administrator, Application Administrator, and Privileged Role Administrator represent high-value targets. Unlike traditional AD, there are no domain controllers to compromise directly. Attackers instead target tokens, OAuth grants, and misconfigured app registrations. Federated identity scenarios — where on-premises AD syncs to Azure AD via Azure AD Connect — create hybrid attack paths. A compromise of the sync account or the AADConnect server can bridge both environments. Understanding this architecture is essential for any practitioner operating in modern enterprise environments.
Detection (Blue Team / SOC)
Detecting attacks against Azure AD requires centralizing sign-in and audit logs into a SIEM. Microsoft Entra ID produces three critical log categories: SignInLogs, AuditLogs, and NonInteractiveUserSignInLogs. Key detection signals include impossible travel events, sign-ins from unfamiliar locations, and bulk consent grants to OAuth applications. In Microsoft Sentinel, the UEBA engine correlates these events with peer baselines. Specific indicators to monitor are: role assignments to new principals (AuditLogs, operationName 'Add member to role'), service principal credential additions, and Conditional Access policy modifications. Token-based attacks such as Pass-the-Token or device code phishing leave traces in NonInteractiveUserSignInLogs with unusual client application IDs. Alert on authentication from legacy protocols (BasicAuthentication) since these bypass MFA. Monitor the AADConnect service account for atypical directory sync activity. Tools like Microsoft Defender for Identity, Hawk, and AzureHound (in audit mode) assist defenders in baselining tenant configurations and identifying anomalous permission chains before attackers exploit them.
Exploitation & countermeasures (Red Team)
Red Teams targeting Azure AD focus on several well-documented attack chains. Device code phishing (RFC 8628) tricks users into authorizing a token without entering credentials on an attacker-controlled page — the resulting refresh token grants persistent access. Tools like TokenTacticsV2 and AADInternals automate token extraction and manipulation. Abusing OAuth application registrations with overly broad API permissions — particularly Mail.ReadWrite or RoleManagement.ReadWrite.Directory — allows privilege escalation without touching user credentials. Illicit consent grant attacks exploit users who approve malicious third-party apps. From a post-compromise pivot standpoint, compromising the Azure AD Connect sync account (MSOL_ prefix) via DCSync on-premises grants the ability to reset any cloud user password. PRT (Primary Refresh Token) theft from hybrid-joined endpoints using tools like ROADtoken enables seamless lateral movement. Hardening priorities include enforcing Conditional Access with MFA for all privileged roles, restricting user consent to verified publishers only, disabling legacy authentication protocols, rotating sync account credentials, and auditing app registrations with high-privilege API permissions quarterly.
Articles about Azure AD
An attacker can access your M365 emails and files without a password through a malicious OAuth app. Here's how it works and how to stop it.
Application Administrator, Helpdesk Administrator… these roles look harmless. Here's how they can be chained to reach Global Administrator.