Intro to Azure Recon with BloodHound

What this lab covers

You collect Entra ID and Azure relationship data, load it into BloodHound, and use the graph to identify paths from a low-privilege starting point to meaningful control over the tenant.

The graph is the point. A role assignment that looks harmless becomes significant when it is one edge in a chain, and the tooling exists because humans are poor at holding thousands of transitive relationships in mind.

It suits defenders as much as testers, and arguably more. Running this against your own tenant is the fastest way to find the escalation paths you did not know you had.

How attack path graph analysis works

Collection walks the directory through its APIs and records objects and the relationships between them: users, groups, service principals, roles, applications and the assignments connecting them. This is read-only activity using documented interfaces.

The data becomes a graph where nodes are principals and resources, and edges are the permissions that let one act on another. Once expressed this way, the question of whether a low-privilege user can reach a high-privilege role becomes a path query rather than an analysis exercise.

The insight is transitivity. An account that can reset a password, belonging to a group that owns a service principal, which holds a privileged application permission, is three benign facts and one serious escalation path. No individual reviewer is looking at all three at once, and the portal does not present them together.

How to detect this in your own environment

Collection is high-volume directory reading and is visible in Entra ID audit and sign-in logs. A single identity enumerating a large portion of the directory in a short window is unusual for anything but a genuine administrative tool.

Baseline which identities legitimately read the directory broadly. In most tenants that is a short list of synchronisation and governance tooling, so anything outside it is worth investigating.

Watch for enumeration from newly created or recently compromised identities in particular, since reconnaissance immediately after a sign-in anomaly is a much stronger signal than either event alone.

How to prevent it

You cannot prevent authenticated directory reading, and attempting to do so breaks legitimate tooling. What you can do is ensure the graph contains fewer paths worth finding.

Run the analysis yourself and remediate what it shows. Every path the tool surfaces is one you can break by removing a role assignment, tightening group ownership or revoking an application permission, and the highest-value fixes are usually a handful of edges.

Reduce standing privilege. Privileged Identity Management style just-in-time elevation removes many edges from the graph entirely, because a role nobody holds permanently is not a path an attacker can traverse on demand.

Real-world context

Graph-based attack path analysis changed how Active Directory security was approached, and the same approach applies to Entra ID because the underlying problem is identical: permissions accumulate, relationships are transitive, and nobody has a complete picture.

Real intrusions follow these paths rather than exploiting the identity platform. Public incident reporting on cloud identity compromise consistently describes chains of legitimate permissions rather than vulnerabilities in the directory itself.

The activity maps to MITRE ATT&CK T1087 Account Discovery, T1069 Permission Groups Discovery and T1482 Domain Trust Discovery.

Applying this at work

• Run AzureHound against your own tenant and look for paths from a standard user to a privileged role. Most organizations find at least one.
• Review who can reset passwords for privileged accounts, which is one of the most commonly overlooked edges.
• Audit application and service principal permissions, since these frequently hold more than the humans who manage them.
• Check group ownership, because owning a group is often equivalent to joining it.
• Move standing privileged roles to just-in-time elevation to remove edges from the graph entirely.

Frequently asked questions

What does AzureHound actually collect?

Objects and relationships from Entra ID and Azure: users, groups, service principals, applications, roles and the assignments linking them. It is read-only collection through documented APIs, which is why it is equally usable by defenders.

Why does a graph find things a permissions review does not?

Because escalation paths are transitive. Each individual assignment looks reasonable in isolation, and the risk only appears when several are chained. Reviewers examine assignments one at a time, and the portal presents them that way.

Can I stop attackers from enumerating my directory?

Not without breaking legitimate tooling, since authenticated users can read directory data by design. The better strategy is to run the same analysis yourself and remove the paths worth finding.

Do I need my own Azure account to practice this?

No. The lab runs in a live Azure environment that Pwned Labs provisions for you, so there is nothing to set up and no risk to your own tenant.

Which certification covers this in depth?

The Microsoft Cloud Red Team Professional (MCRTP) covers Entra ID, Azure and Microsoft 365 attack paths in full, including token abuse, phishing tradecraft and privilege escalation, and is assessed hands-on in a live tenant.