Module 1 · Microsoft Entra ID Security

Last updated: April 29, 2026

Microsoft Entra ID (formerly Azure Active Directory) is the identity backbone for Microsoft 365 and Azure cloud — and increasingly for SaaS apps via SSO. Compromise of Entra ID is the modern equivalent of compromising Active Directory: the attacker can become any user, access any tenant resource, and pivot to other clouds via federated trust. This module covers Entra ID security, the attack patterns, and the controls that matter.

Entra ID 101

• Cloud-native identity provider; SaaS multi-tenant
• Holds users, groups, applications, devices, conditional-access policies
• Issues tokens for OAuth 2.0, OpenID Connect, SAML
• Differs from on-prem AD: no Kerberos, no NTLM, no domain controllers (you connect to graph.microsoft.com)
• Hybrid mode common: Entra Connect synchronizes from on-prem AD; same identity used both places

Roles that matter

• Global Administrator — root of the tenant; can do anything; should be 2-5 people max
• Privileged Role Administrator — assigns roles to others; effectively also root
• Application Administrator — manages all apps; can grant consent
• Cloud Application Administrator — similar but only for cloud apps
• Authentication Administrator — resets MFA; powerful
• Sixty other built-in roles — least-privilege candidates

Audit Global Admins quarterly. Move admin work to least-privilege roles + Privileged Identity Management (PIM) for time-bounded elevation.

Common attack patterns

Password spray

Attackers try a single password across many accounts. Without smart lockout / Conditional Access protection, hundreds of accounts can be tested per hour without lockouts. Tools: MSOLSpray, MailSniper.

Token theft

Stealing a primary refresh token (PRT) or access token from an endpoint = bypass of MFA. The attacker authenticates as the user without password or MFA prompt. Sources: malware on endpoint, infostealers, AitM phishing.

Adversary-in-the-middle (AitM) phishing

Modern phishing uses tools like Evilginx2 to proxy login through attacker infrastructure — captures credentials AND session cookies after MFA. The “MFA stops phishing” assumption breaks here.

Consent phishing

Attacker creates a malicious app, sends victim a consent link asking for Mail.Read, Files.Read.All. Victim consents; attacker has persistent OAuth access. Bypasses MFA entirely.

Hybrid AD pivot

Compromise on-prem AD via classic methods (Kerberoasting, etc.); the synced account has equivalent privileges in Entra ID. Or compromise Entra ID and use seamless SSO to access on-prem resources.

Service principal abuse

Apps register as Service Principals with permissions. A compromised SP with Mail.Read can read all mailboxes. SPs often over-permissioned and rarely audited.

Cross-tenant access policies (CTAP)

Misconfigured B2B/external collaboration policies can give external parties more access than intended.

Defenses — the priorities

1. MFA on every account — Conditional Access with strong MFA. FIDO2 keys preferred; phone calls/SMS deprecated
2. Conditional Access policies — device compliance, location, sign-in risk, app risk. Block legacy auth (POP/IMAP/SMTP basic) entirely
3. Privileged Identity Management (PIM) — time-bounded role activation; approval workflow for sensitive roles
4. Application consent governance — admin-consent-required for high-risk scopes; review user consents
5. Sign-in risk policies — Identity Protection auto-blocks/MFA-prompts on impossible travel, unfamiliar features
6. Number matching for MFA — defeats MFA fatigue attacks
7. Continuous Access Evaluation (CAE) — sessions revoked within seconds of risk events
8. Token Protection — bind tokens to device; reduces token theft impact

Conditional Access — the policies that matter

• Block legacy authentication — single biggest control. Legacy auth bypasses MFA
• Require MFA for all users — start broad, then refine for service accounts
• Require compliant device for admins — admins use managed/compliant endpoints
• High sign-in risk → MFA or block
• High user risk → password reset
• Block sign-ins from unsupported countries
• Require MFA for Azure portal / management endpoints

Auditing your tenant

• BloodHound Azure — graph-based attack path visualization for Entra. Equivalent to BloodHound for AD
• Azure AD Toolkit / AzureHound — collect data for BloodHound
• ScubaGear — CISA-published auditor for M365/Entra against secure baselines
• Microsoft Secure Score — built-in posture metric; treat as starting point not endpoint
• PowerShell modules — AzureAD, MSOnline, Microsoft.Graph for scripted audits

Logging — what to collect

• Sign-in logs — every authentication; export to SIEM
• Audit logs — every admin action
• Risk events — Identity Protection findings
• Provisioning logs — for federated/synced accounts

30-day retention in Entra by default; longer requires Sentinel or another SIEM. KQL queries against Sentinel are the operational interface for hunting.

Hybrid identity — additional surface

If you sync from on-prem AD via Entra Connect:

• Entra Connect server has DCSync rights — protect like a domain controller
• Pass-Through Authentication agents authenticate against on-prem AD — protect
• Federation trust (ADFS or third-party) — compromise of trust = full tenant takeover
• Seamless SSO uses a computer object in AD with a known SPN; pre-2024 was vulnerable to silver-ticket-style forging; patched but verify

Service Principal hygiene

• Quarterly review of all SPs and their permissions
• Remove unused SPs (reporting on last sign-in)
• Workload identity federation over secrets where possible
• Certificate-based auth over secrets for SPs that need static creds
• Monitor for new SPs created — alert on unusual creators

India-specific considerations

• Data residency — Entra metadata stored regionally; document for compliance
• DPDP — Entra holds personal data of employees; covered as employee data processor
• RBI — for banks, Entra usage subject to outsourcing guidelines

Recommended baseline for Indian SaaS in 2026

1. FIDO2/WebAuthn MFA for all admins; phishing-resistant
2. Conditional Access blocking legacy auth, requiring compliant devices for admins
3. PIM enabled for all privileged roles; standing access only for break-glass
4. Sign-in logs to SIEM with 1-year retention
5. Service principal audit quarterly
6. Tenant restriction policies for B2B
7. Conditional Access policy for unmanaged devices accessing email/Office

This is the modern Entra ID baseline. The attack surface has shifted from password complexity to token theft and AitM — defenses must follow.