Identity is the front door to the Microsoft cloud, and Entra ID (formerly Azure Active Directory) is the identity system that guards it. It authenticates users, issues tokens, governs access to Azure and Microsoft 365, and bridges on-premises Active Directory to the cloud. That makes it one of the highest-value targets an attacker can reach, and one of the most misunderstood and easily misconfigured. This guide covers how attackers actually compromise Entra ID, the specific techniques that recur in real engagements, and how defenders detect malicious activity, contain and evict them.
What is Entra ID and why attackers target it
Entra ID is Microsoft's cloud identity and access management service. Every sign-in to Microsoft 365, every Azure resource permission, and much of the hybrid identity in a modern enterprise runs through it. If you compromise an identity with privileged roles in Entra ID, you are not just attacking one server, but the control plane for the entire tenant.
The critical shift from traditional on-premises Active Directory is that Entra ID is internet-facing by design. There is no traditional network perimeter to breach first. An attacker with a managed identity token gained from an internet-facing web application, credentials from phishing, or accidentally committed service principal credentials is already inside the identity layer. This is why identity, not the network, is the real perimeter in the cloud.
Common Entra ID attack techniques
The following techniques commonly appear in real assessments of Microsoft cloud tenants. Most abuse legitimate identity features rather than software vulnerabilities.
Reconnaissance and user enumeration
Before authenticating, attackers enumerate a tenant: discovering the tenant's federation and authentication settings, identifying the email address format and validating which email addresses exist. Much of this is possible unauthenticated, using the same endpoints legitimate clients use.
A tenant's OpenID Connect metadata and user-realm discovery endpoints reveal a great deal of information even before anyone authenticates, including whether the tenant uses managed authentication or federation, which shapes the rest of the attack. Tooling such as AADInternals are able to automate much of this unauthenticated reconnaissance.
Password spraying and token theft
Rather than brute forcing one account and risk locking it out, attackers spray one or a small number of passwords across many accounts to stay under lockout thresholds. Increasingly, the higher-value move is stealing credentials and ESTS cookies directly, through adversary-in-the-middle phishing. The gained cookies have already satisfied MFA, and allow a threat actor to register and device in Entra ID and enroll it in InTune.
Once they have a foothold, threat actors can perform token abuse to move seamlessly between different related applications, such as Teams, Outlook and SharePoint. Refresh tokens are long-lived and can be exchanged for fresh access tokens to different resources, giving an attacker both persistence and lateral movement across the Microsoft cloud. Open-source tooling such as ROADtools Token eXchange (roadtx), TokenTactic and AADInternals can automate this process.
Enumerating and bypassing Conditional Access
Conditional Access Policies are the rules that decide when multi-factor authentication and other controls are required, and they are only as strong as their exclusions. Attackers enumerate the gaps from an external perspective using tools such as findmeaccess: gaps that can arise from an excluded user, a trusted or overlooked device platform, a legacy authentication protocol that skips modern controls, an excluded application. Once a hole is found, a token obtained through that path sidesteps the MFA requirement entirely. Tools like ROADrecon can be used from an internal perspective to dump a tenant's Conditional Access policies for offline analysis, using the deprecated (but still functional) Azure AD Graph. Many of the conditional access gaps in the environment will then be easy to identify.
Device code and consent phishing
Device code phishing abuses the legitimate device authorization flow to trick a user into authorizing the attacker's session. Consent phishing goes further: the victim grants a malicious application OAuth permissions to their data, and the attacker retains access through that application even after a password reset. Because Microsoft now restricts default user consent to verified publishers and a set of low-risk permissions, the high-impact version of this attack usually targets an administrator, whose consent can approve the sensitive Graph permissions an attacker actually wants. Tenants that still allow broad user consent remain exposed at the user level.
Abusing application and service principal permissions
Applications and their service principals are identities too, and they are often over-permissioned and poorly monitored. An attacker who compromises an application secret or certificate, or who can add credentials to an existing service principal, gains a persistent, non-human identity with whatever permissions that application holds. These identities are also commonly not subject to MFA requirements.
Once inside Microsoft 365, attackers use post-exploitation frameworks such as GraphRunner or custom tooling to enumerate and pillage data across mailboxes, SharePoint, and Teams through the Graph API, all under a legitimate-looking application identity.
Role and privilege escalation
Highly privileged roles such as Global Administrator, Privileged Role Administrator, and Application Administrator are frequent escalation targets. Certain roles allow the holders to grant themselves or others additional access, add credentials to privileged applications, or manipulate group membership to inherit rights, turning a moderate foothold into tenant control. A common example of this is users assigned the Application Administrator or Cloud Application Administrator being able to create credentials for a service principal that is assigned the Global Administrator role.
Abusing dynamic groups and administrative units
Dynamic group membership is driven by user attributes. If an attacker can edit an attribute that they control, they can satisfy the rule for a privileged group and inherit its access automatically. Misconfigured Dynamic group-based access is a quiet but effective escalation path.
A common variant is infiltrating a dynamic group through a guest invitation: if the group's membership rule depends on a specific attribute (such as admin being in the email address), an attacker can invite a guest user named dev-admin-mbt@outlook.com to the tenant, who will automatically be a member of the dynamic group and inherit its access.
Hybrid identity and pivoting to the cloud
In hybrid environments, on-premises Active Directory syncs to Entra ID. Compromising the sync account, Seamless SSO, seed identities, or federation trust can turn an on-premises foothold into cloud tenant access. The reverse pivot from cloud into on-premises is equally valuable to an attacker, and sometimes it is possible to move back and forth between them, increasing access with each turn.
How the two directories are joined matters. Microsoft Entra Connect can sync with Password Hash Synchronization, Pass-through Authentication, or Federation, and each creates different attack surface, from the privileged synchronization service account to the federation trust that can be abused to forge tokens. Knowing which model a tenant uses tells an attacker how to pivot in either direction between on-premises and the cloud.
A practical methodology for testing Entra ID
- Enumerate the tenant. Map users, groups, roles, applications and authentication settings from an external and low-privileged position.
- Gain a foothold. Through token theft, consent or device-code phishing, sprayed credentials, or a leaked application secret.
- Enumerate as the identity. Determine the roles, group memberships, and application permissions available to the compromised identity.
- Escalate. Chain role permissions, application credential abuse, and group manipulation. Attack-path mapping tools such as BloodHound Community Edition make these chains visible, including well-worn paths like Application Administrator to Global Administrator.
- Establish persistence and demonstrate impact. Add application credentials, review what defenders record in the sign-in and audit logs, and achieve the objective across Azure and Microsoft 365.
How defenders protect Entra ID
- Enforce phishing-resistant multi-factor authentication and Conditional Access, and treat token theft as a real threat, not just password compromise.
- Inventory and monitor applications and service principals, and alert on new credentials added to privileged applications.
- Apply least privilege to directory roles, use Privileged Identity Management for just-in-time elevation, and review Global Administrator assignments.
- Watch the Entra ID sign-in and audit logs for consent grants, device-code sign-ins, and role changes, and test the tenant adversarially to see which paths actually reach admin.
Learn Entra ID attacks hands-on
You cannot learn identity attack paths from a diagram. You learn them by executing them against a real tenant. Pwned Labs teaches this in live Microsoft cloud environments you are given to attack, from unauthenticated enumeration to tenant takeover and hybrid pivots. Work through hands-on Azure and Microsoft 365 security labs, then prove the full attack chain with the Microsoft Cloud Attack and Defense bootcamp and MCRTP certification, or go deeper into hybrid with the Microsoft Cloud Red Team Expert path. If your organization needs an expert team to test its own tenant, see our Azure penetration testing services.
Frequently asked questions
What is the difference between Entra ID and Active Directory?
Active Directory is the on-premises directory service that uses protocols like Kerberos and LDAP inside a network. Entra ID is Microsoft's cloud identity service, internet-facing and token-based, governing access to Microsoft 365 and Azure. Many enterprises run both in a hybrid model where the two are synced.
Can attackers bypass MFA in Entra ID?
Yes, in practice. Adversary-in-the-middle phishing steals the post-authentication session token, which sidesteps multi-factor authentication entirely. This is why phishing-resistant methods and Conditional Access matter more than MFA alone.
What is the most dangerous Entra ID role to compromise?
Global Administrator is the highest-value target, but Privileged Role Administrator and Application Administrator are close behind because they can grant further access or add credentials to privileged applications, which leads to the same outcome.
Why do attackers want Entra ID refresh tokens?
A refresh token is long-lived and can be exchanged for fresh access tokens to different Microsoft cloud resources such as Microsoft Graph, SharePoint, and Teams. Stealing one gives an attacker both persistence and lateral movement, often without re-triggering multi-factor authentication, which is why refresh tokens are a prime target.
How do I practice Entra ID attacks safely and legally?
Use environments built for it. Hands-on labs and cyber ranges provide live, intentionally vulnerable Microsoft cloud tenants to attack, so you build real tradecraft without touching production systems.
The fastest way to get good at this is to attack a real tenant end to end. Explore the hands-on cloud security labs and work a full Entra ID compromise from enumeration to tenant admin.