Surprising ways to escalate privileges in Entra ID
summary
Entra ID has 105 roles and common misconfigurations let low‑privilege accounts escalate to Global Admin by adding app credentials or abusing delegated scopes. Demos show using PowerShell and Microsoft Graph to add a client secret to a service principal via MS Graph (the secret appears only on the service principal), using organization.readWriteAll can add a trusted root cert to enable certificate‑based impersonation, and combining role‑assignable groups with PIM to bypass expected password‑reset protections. Administrative units and managed identities mitigate but require careful RBAC.
AI-written summary · about
chapters (11)
- 0:00Entra ID privilege escalation
- 1:59What we will cover and avoid in this talk
- 7:44Privileged Identity Management basics
- 15:23Misusing admin roles
- 20:50App registration dangers
- 30:57Adding secrets to service principals
- 37:01Graph Scopes risks
- 43:57Securing app credentials
- 44:42Managed identities risks
- 50:33Key takeaways
- 53:03Q&A
related talks
51mMeasures for Securing Privileged Users in M365&Azure Every Organization Should Take
58mPrivilege Escalation in Microsoft Azure
50mDesigning an IAM Strategy for your Engineering Platform
09mThe dark art of OIDC abuse - A case study in Entra ID
45mSecure your Intelligent Applications with Microsoft Entra
49mAll You Need Is Guest
47mBuild secure applications with External Identities in Microsoft Entra
51mAdvanced Attack Vectors in Azure Environments