Writing Your Own Ticket to the Cloud Like APT: A Dive to AD FS Attacks, Detections, and Mitigations

Azure Active Directory (Azure AD) is Microsoft's cloud-based identity and access management solution used by Microsoft 365, Azure, and thousands of third-party service providers. Almost all Fortune 500 companies have adopted Azure AD, mainly by consuming Microsoft 365 services like Exchange, Teams, and SharePoint. Of these companies, the majority have chosen identity federation as their authentication method. Microsoft Active Directory Federation Services (AD FS) is a technology often used to implement the identity federation for Azure AD. As with any …

access access management active directory ad fs apt attacks authentication azure azure active directory azure ad cloud cloud-based companies consuming detections directory dive exchange identity identity and access identity and access management identity federation management microsoft microsoft 365 mitigations own party service service providers services sharepoint solution teams technology third third-party writing