Abusing Azure Active Directory: From MFA Bypass to Listing Global Administrators

The majority of Fortune 500 organizations are using Azure Active Directory (Azure AD) as Identity and Access Management (IAM) solution. The high adoption rate makes Azure AD a lucrative target for threat actors, including state-sponsored actors like APT29/Nobelium.

Azure AD is leveraging Microsoft's not-so-well-documented Evolved Security Service (eSTS). eSTS hides multiple security token services so that users see only Azure AD.....

By: Sravan Akkaram , Nestori Syynimaa (DrAzureAD)

Full Abstract and Presentation Materials:
https://www.blackhat.com/asia-23/briefings/schedule/#abusing-azure-active-directory-from-mfa-bypass-to-listing-global-administrators-30860

abusing access access management active directory administrators adoption apt29 azure azure active directory azure ad bypass directory global high iam identity identity and access identity and access management listing management mfa microsoft nobelium organizations rate security service solution sponsored state target threat threat actors