Abusing Azure Active Directory: From MFA Bypass to Listing Global Administrators
summary
Demonstrates a concrete exploit chain: attackers with a stolen password can log into certain B2C/fallback resource tenants without triggering home-tenant MFA, enumerate all tenant memberships, then pivot to any tenant that lacks MFA. Shows an access package API leak that returns creator/modifier emails (including Global and User Admins), enabling targeted escalation or social engineering. Code references an open tool (aad tunnels / AAD Internals) used to automate the flow, five issues reported to Microsoft, fixes and doc changes roll out over ~18–24 months with some bugs reappearing.
AI-written summary · about
chapters (7)
- 0:00Start
- 3:47Azure Active Directory
- 4:36Evolved Security Token Service (eSTS)
- 5:26Home and Resource tenants
- 7:17Cross-tenant access settings
- 20:02Communication with Microsoft 2/3
- 34:00Communication with Microsoft 2/2
related talks
51mAdvanced Attack Vectors in Azure Environments
58mPrivilege Escalation in Microsoft Azure
38mAll You Need is Guest
50mHybrid Active Directory Attacks: Anatomy and Defenses
23mHacking Exposed: Next-Generation Tactics, Techniques, and Procedures
55mOffensive Azure Security
55mAzure Attacks Unpacked: Real-World Threats & Lessons
40mWhat’s Old is New: Hybrid Security for Microsoft Azure and On-Premises Tech