Azure Entra ID for Red Teamers

Course Synopsis

A full attack lifecycle against Microsoft Entra ID, taught from the token and the wire protocol up. Fifteen modules run from tenant reconnaissance and initial access through token abuse, Graph enumeration, privilege escalation, hybrid identity, and tenant persistence, then double back to cover the identity protocols themselves in depth: OAuth grant types, the application and consent model, token validation, alternative authentication, MFA weaknesses, Conditional Access, and detection evasion.

Every technique is followed by working code and a lab exercise against a dedicated training tenant, with a solution walkthrough for each. AzureRedOps, an open-source Python toolkit, is used throughout.

Coming Soon →

Foundation - Modules 1 to 8

Module 01

Entra ID Architecture and OAuth 2.0 Internals

The Tenant Object Model

  • How a tenant is structured and where the isolation boundaries actually sit
  • Multi-tenant architecture and cross-tenant exposure
  • OIDC discovery: pulling tenant metadata and the full endpoint map
  • v1.0 versus v2.0 token endpoints and the differences that matter

Tokens and Identities

  • JWT anatomy and a claim-by-claim walk through an access token
  • OAuth 2.0 grant types ranked by attacker relevance
  • App registration versus service principal versus managed identity
  • Delegated versus application permissions
  • The app registration manifest and its security-relevant fields

Policy Surface

  • Claims mapping policies and injecting custom token claims
  • Token lifetime policies as a persistence mechanism
  • Entra ID directory roles versus Azure RBAC, and the scope confusion between them
Module 02

Initial Access: Recon, Spraying, and Phishing

Tenant Reconnaissance

  • Unauthenticated tenant discovery and what it reveals
  • Reading authentication error codes as user and state enumeration intelligence

Credential Attacks

  • ROPC authentication and where it still works
  • Credential spraying mechanics, multi-target orchestration, and result parsing
  • Interpreting spray results: MFA responses, lockout handling, and conditional access signals
  • Legacy protocol initial access over SMTP and IMAP

Device Code Phishing

  • The device authorization grant and its wire protocol
  • The polling loop and how the token is finally issued
  • Delivery, pretext, and social engineering considerations
  • Browser session harvesting as an alternative to phishing a code

Token Handling and Labs

  • Saving, viewing, and refreshing captured tokens, and expanding their scope
  • ROPC versus device code: choosing the right initial access vector
  • Hands-on: tenant recon, credential spraying, and device code phishing
Module 03

Token Attacks: FOCI, OBO, and Refresh Token Abuse

Refresh Token Mechanics

  • How refresh tokens are issued, rotated, and revoked
  • FOCI: first-party client ID families and why one token unlocks many apps
  • The FOCI pivot on the wire, and automating it across a client family

On-Behalf-Of Chaining

  • The JWT-bearer grant and the exact HTTP request it requires
  • Configuration prerequisites that make an application exploitable
  • Public client variants and multi-hop chains across three services
  • Token exchange and audience and scope manipulation

Token Theft and Replay

  • Where tokens are stored: browser-side locations and process memory
  • Extracting tokens protected by platform credential storage
  • Audience confusion: using a token issued for one service against another
  • Detection and response around refresh token revocation
  • Hands-on: a FOCI token pivot and an OBO attack
Module 04

Graph Enumeration and Magic App Discovery

Microsoft Graph as a Recon Platform

  • The Graph API surface and the core enumeration activities
  • Bulk tenant collection in a single pass
  • Beta endpoint exposure: data the production endpoint will not return

Finding the Exploitable Application

  • What makes an application exploitable, and how to search a tenant for one
  • Consent grant abuse and tenant-wide grants
  • First-party application discovery and building a target list
  • Mailbox search through Graph

What Graph Recon Reveals

  • App roles and custom OAuth scopes
  • Conditional Access policies and named locations
  • PIM eligible role assignments
  • Devices and Intune compliance state
  • Hands-on: full-tenant Graph collection and exploiting a discovered application
Module 05

Privilege Escalation: Roles, Consent, and PIM

Directory Role Escalation

  • Entra ID directory role RBAC and the high-value role attack surface
  • Role assignment through Graph
  • Role-assignable groups: escalation through group membership
  • Dynamic groups: escalation by manipulating a user attribute
  • Administrative units and scoped privilege bypass

Consent and Application Escalation

  • Admin consent phishing
  • Application permission escalation through a newly registered app
  • Guest user invitation as an escalation and persistence primitive
  • Cross-tenant escalation through B2B guest role assignments

Privileged Identity Management

  • PIM activation abuse and eligible role assignments
  • Approval bypass and roles configured without an approver
  • Hands-on: role escalation through Graph
Module 06

PRT, Browser SSO, and Hybrid Identity

The Primary Refresh Token

  • What a PRT is and why it is the highest-value credential on a joined device
  • PRT extraction from a live host
  • The PRT cookie format and the minting chain end to end
  • Using a PRT to satisfy a compliant-device Conditional Access requirement

Browser Single Sign-On

  • Three SSO modes and when each applies
  • Harvesting session cookies and reusing them

Hybrid Identity Attack Paths

  • Entra Connect: the full attack surface between on-premise AD and the tenant
  • Seamless SSO and the Kerberos attack against the computer account behind it
  • Pass-through authentication and the agent backdoor
  • The directory synchronisation account and the privilege it holds
  • Hands-on: PRT minting with browser SSO, and a full hybrid identity attack path
Module 07

Persistence: App Backdoors and Long-Lived Tokens

Application-Based Persistence

  • App registration as a persistence mechanism
  • Adding secret credentials to an application you control
  • Backdooring an existing enterprise application
  • Certificate credentials and why they are harder to spot

Secretless and Federated Persistence

  • Workload identity federation as a backdoor with no stored secret
  • Managed identity persistence through instance metadata token access
  • Partner delegated admin relationships as persistent cross-tenant access

Token Longevity and Layering

  • Long-lived token techniques and the sliding refresh window
  • Detecting revocation and regaining access afterwards
  • Stacking multiple independent persistence mechanisms
  • Hands-on: a certificate credential backdoor and a full-chain capstone
Module 08

Detection, Defense, and Conditional Access Gaps

What Defenders See

  • Sign-in log sources and what each one records
  • Correlating a stolen token back to its originating sign-in event
  • Entra ID Protection risk detections
  • OAuth application detection in cloud app security tooling

Detecting the Attacks in This Course

  • Device code phishing detection
  • OBO and token chaining detection
  • PRT abuse detection
  • Application backdoor and consent grant detection
  • Threat hunting a FOCI pivot and a credential spray by error-code analysis

Coverage Analysis

  • Conditional Access policy gaps as a defensive finding
  • Detection coverage mapped against every technique taught
  • Defensive recommendations worth putting in a report

Deep Dive - Modules 9 to 15

Module 09

OAuth 2.0: All Grant Types and Attack Surfaces

Every Flow on the Wire

  • Authorization code, with and without PKCE
  • Client credentials, including certificate authentication
  • ROPC, and its error codes as enumeration intelligence
  • The device authorization grant, its polling protocol, and timing considerations
  • Refresh token flow and rotation behaviour
  • On-behalf-of, SAML bearer assertion, and JWT bearer client authentication
  • Implicit flow: deprecated, still enabled, still useful

Manipulating the Exchange

  • Token exchange and scope and audience manipulation
  • Proof-of-possession tokens and mTLS binding
  • Grant type restrictions and how they interact with Conditional Access
  • Common grant type misconfigurations
  • Token endpoint error analysis as an intelligence source
  • Hands-on: an OAuth grant type lab covering every flow
Module 10

Application Model, Permissions, and Consent

The Application Object

  • App registration versus service principal, in technical detail
  • The manifest fields that decide the attack surface
  • signInAudience and multi-tenant exposure
  • allowPublicClient, appRoleAssignmentRequired, and accepted token versions
  • Service principal types: application, managed identity, and legacy

Permissions and Consent

  • Delegated versus application permissions, at the protocol level
  • Defining custom API scopes and app roles, and abusing both
  • The consent framework: user, admin, and tenant-wide consent
  • Pre-authorization: known client applications and pre-authorized applications
  • Cross-tenant app access and multi-tenant consent abuse

Finding and Abusing Overprivileged Apps

  • Hunting overprivileged applications through Graph
  • Assigning app roles to a principal you control
  • Adding credentials to an existing service principal
  • Workload identity federation and managed identities
  • Partner access through delegated admin privilege
  • Hands-on: an application permissions lab
Module 11

Audiences, Scopes, and Token Validation

Reading a Token Properly

  • JWT header, payload, and signature
  • The aud claim in v1.0 and v2.0 form
  • The iss claim and tenant isolation
  • The scp claim for delegated permissions and roles for application permissions
  • Access token, ID token, and refresh token compared claim by claim

Scope Mechanics

  • The .default scope: how it works and how it is exploited
  • Resource ID disambiguation and multi-resource token scoping
  • Scope elevation: requesting beyond what was consented
  • Incremental consent and requesting additional scopes mid-session

Where Validation Fails

  • What a resource server is actually required to check
  • Audience confusion attacks and resource servers that accept multiple audiences
  • Token lifetime defaults, configurable values, and continuous access evaluation
  • Client capability claims and the replay window they leave open
  • Sender-constrained tokens as a mitigation
  • Hands-on: a token analysis lab
Module 12

Authentication Methods Beyond OAuth

Federation Protocols

  • SAML 2.0: SP-initiated and IdP-initiated flows and their attack surface
  • Golden SAML: token forgery at the identity provider
  • The SAML assertion fields a service provider must validate
  • WS-Federation and WS-Trust
  • External IdP federation over SAML and OIDC

Credential Types

  • Certificate-based authentication and acquiring an OAuth token with a certificate
  • FIDO2 and WebAuthn passkey authentication
  • Temporary access pass as a one-time MFA bypass
  • Windows Hello for Business and TPM-backed authentication
  • Windows integrated authentication through a federation server

Legacy and Guest Paths

  • Seamless SSO and pass-through authentication
  • Legacy authentication protocols and their attack surface
  • Basic versus modern authentication at the protocol level
  • B2B guest authentication flow
  • How MFA binds to each method, and a full attack surface map
  • Hands-on: an alternative authentication lab
Module 13

MFA Weaknesses and Legacy Authentication

Attacking Enrollment

  • The MFA registration process and its attack surface
  • Attacker self-registration of a second factor
  • Self-service password reset as an initial access path, and the token issued afterwards
  • Phone number hijacking and SIM swap impact

Attacking the Prompt

  • MFA fatigue and push bombing
  • Number matching: how it works and where the gaps are
  • Additional-context weaknesses in push approval

Bypassing MFA Structurally

  • App passwords and legacy protocol bypass
  • Detecting which legacy protocols a tenant still permits
  • When ROPC triggers MFA and when it does not
  • Client credentials: why MFA is structurally impossible
  • Federated SSO: MFA enforced at the IdP but not the service provider
  • Device compliance substituting for MFA, and trusted IP exemptions
  • Authentication strength policy gaps and guest MFA trust settings
  • Per-user MFA versus policy-based MFA and the gap between them
  • Hands-on: a tenant-wide MFA weakness assessment
Module 14

Conditional Access: Architecture and Bypass

How Policy Evaluation Works

  • The policy evaluation model, condition by condition
  • What triggers a policy: users, apps, platforms, locations, and risk
  • Grant controls and the enforcement options behind them
  • Named locations, trusted networks, and country lists
  • Client app conditions and the modern versus legacy split

Finding the Gaps

  • Automated policy gap analysis through Graph
  • Excluded users and break-glass accounts
  • Excluded applications and unprotected resources
  • Service principal sign-ins with no policy coverage at all

Bypass Techniques

  • Legacy authentication and ROPC bypass
  • Device code flow against a policy set
  • Compliant device and hybrid join requirement bypass
  • Continuous access evaluation and how older client libraries sidestep it
  • Guest and B2B MFA trust bypass
  • Sign-in frequency and persistent session controls
  • A bypass decision tree and an attack-versus-control gap matrix
  • Hands-on: Conditional Access gap analysis through the Graph API
Module 15

Detection Evasion in Entra ID Environments

Log Coverage and Its Holes

  • Every Entra ID log table and what lands in each
  • The non-interactive sign-in gap and how ROPC exploits it
  • Service principal sign-ins recorded in a separate table
  • Actions that produce no audit log entry at all

Blending In

  • User agent spoofing for device platform evasion
  • Source IP considerations and residential proxy use
  • Victim location consistency during device code phishing
  • A FOCI pivot rendered as an ordinary first-party token refresh
  • OBO chains and the cross-log correlation difficulty they create
  • PRT abuse and its minimal audit footprint
  • Blending a malicious app registration into a legitimate tenant
  • Token replay inside the access token validity window
  • Operational timing and footprint minimisation
Coming Soon → Buy the All Training Bundle →