Defend Against Azure Cross-Tenant Synchronization Attacks

Originally published by CrowdStrike. Azure cross-tenant synchronization (CTS) was made generally available on May 30, 2023, and introduced a new attack surface on Microsoft Entra ID (formerly Azure Active Directory) where attackers can move laterally to a partner tenant or create a backdoor on an existing tenant.CrowdStrike showcases two observed attack paths to outline how adversaries can abuse CTSAs Microsoft Azure continues to gain market share in the cloud infrastructure space, it has gar...

active directory attack attackers attack paths attacks attack surface azure azure active directory backdoor can crowdstrike cts directory entra entra id may microsoft microsoft entra microsoft entra id partner synchronization