Ab)using the Microsoft Identity Platform: ExploringAzure AD Token Caching

This presentation examines how JSON Web Token (JWT) caching works in corporate settings with Azure Active Directory (Azure AD) integration, including Azure AD Joined and Hybrid environments. These tokens, accessible to local users, interface with a variety of authorized protected web services. Local attackers can leverage these tokens to access critical corporate resources, like Outlook, Drive, SharePoint, and Teams. While API access is interesting, its operational implications are not always ideal. On the IBM Adversary Services team, we have developed …

access active directory attackers azure azure active directory azure ad corporate critical directory environments hybrid identity integration interface joined json jwt local microsoft platform presentation services settings token tokens web web services