What Is Entra ID Security?

Why Entra ID Is a Prime Target

Entra ID is the identity backbone for Microsoft 365 and, for most organizations, the front door to email, files, Teams, and every application behind single sign-on. Compromising it does not just grant access to one system; it grants access to the trust fabric that every other system relies on. Because so many organizations federate their entire workforce through Entra ID, it has become one of the highest-value targets in enterprise security, and the incidents below show how nation-state and criminal groups alike prioritize it.

Common Attack Vectors Against Entra ID

Password spray attacks remain the most frequent initial access technique against Entra ID. Attackers test a small number of commonly used passwords against a large list of user accounts, staying below lockout thresholds. Groups like Midnight Blizzard (formerly Nobelium) and Peach Sandstorm have used password spraying as their primary entry point in major campaigns. The attack succeeds surprisingly often because organizations with thousands of accounts almost always have users with weak passwords, and legacy authentication protocols that bypass MFA can be exploited if not explicitly blocked.

Token theft has become the dominant post-authentication attack technique. Once an attacker obtains a valid session token or refresh token, through malware, adversary-in-the-middle phishing frameworks like Evilginx, or by extracting tokens from compromised endpoints, they can bypass MFA entirely because the token represents an already-authenticated session. The stolen token grants access to every resource the user can reach, often including Microsoft Graph API access to email and files.

Device code phishing exploits the OAuth 2.0 device authorization flow. The attacker initiates a device code flow, then tricks a victim into entering the code at microsoft.com/devicelogin, which grants the attacker a token for the victim's session. This attack is particularly effective because the authentication happens on a legitimate Microsoft domain, making it difficult for users to recognize as a phishing attempt. Storm-2372 has used this technique extensively.

Consent grant abuse (also called illicit consent grant) involves tricking a user or administrator into granting an attacker-controlled application permissions to the organization's data. An application registered in an external tenant requests permissions like Mail.Read, Files.ReadWrite.All, or User.Read.All through the OAuth consent flow. If the organization allows user consent to applications, which is the default configuration, any user can grant these permissions without administrator approval.

Application registration abuse targets the application objects within the tenant itself. Attackers who gain access to a user with the ability to register applications (the default for all users in Entra ID) can create a new application, add credentials to it, and assign it API permissions. If an administrator later grants admin consent to a seemingly legitimate application, the attacker gains persistent, token-based access that survives password resets.

Notable Entra ID Attacks

Midnight Blizzard, 2024

The Russian state-linked group APT29 password-sprayed a legacy, non-production test tenant that lacked MFA, then abused an OAuth application's permissions to pivot into Microsoft corporate email. It is a clean example of how a forgotten identity and an over-permissioned application chain into a serious breach.

Storm-0558, 2023

Attackers obtained a Microsoft consumer signing key and used it to forge authentication tokens, gaining access to Exchange Online mailboxes across multiple government organizations. The incident highlighted how token and key integrity underpins the entire identity model.

Scattered Spider

This group repeatedly social-engineers help desks into resetting credentials and MFA, then moves quickly through Entra ID into connected cloud and SaaS resources, a reminder that the human process around identity is part of its attack surface.

Critical Entra ID Security Configurations

Conditional Access policies are the primary defense layer. Effective policies require MFA for all users (including guests), block legacy authentication protocols entirely, restrict access from unmanaged devices, enforce compliant device requirements for sensitive applications, and apply risk-based policies that challenge or block authentication when Entra ID Protection detects anomalous sign-in behavior.

Privileged Identity Management (PIM) enforces just-in-time access for administrative roles. Instead of permanently assigning Global Administrator or Exchange Administrator, PIM requires administrators to activate their role for a limited time window with MFA verification and optional approval workflows. This reduces the window of opportunity if an administrative account is compromised.

App consent policies should be restricted to prevent users from consenting to applications on their own. The recommended configuration requires administrator approval for all application consent requests, with a defined admin consent workflow. Organizations should also regularly audit existing application permissions using Microsoft Graph API or tools like ROADtools to identify applications with excessive or suspicious permissions.

Offensive and Defensive Tooling

ROADtools, developed by Dirk-jan Mollema, is the standard tool for Entra ID reconnaissance and analysis. ROADrecon dumps the entire Entra ID configuration (users, groups, applications, service principals, role assignments, and policies) into a local database for offline analysis. This gives both attackers and defenders a complete picture of the tenant's identity configuration.

AADInternals, created by Nestori Syynimaa, provides a comprehensive PowerShell toolkit for Entra ID administration and security testing, including capabilities for token manipulation, federation exploitation, and pass-through authentication abuse. TokenTacticsV2 focuses specifically on token-based attacks: acquiring, refreshing, and leveraging access tokens and refresh tokens across Microsoft services.

On the detection side, Microsoft Sentinel provides dedicated analytics rules for Entra ID threats. Key detection tables include SigninLogs (authentication events including risk scores), AuditLogs (directory changes including application registration and permission grants), and AADServicePrincipalSignInLogs (non-human identity authentication). Custom KQL detections can correlate across these tables. For example, detecting when a new application is registered, granted high-privilege API permissions, and used to access data within a short time window.

Entra ID vs. On-Premises Active Directory

Entra ID is not simply Active Directory in the cloud. Active Directory uses Kerberos and NTLM over a network you control; Entra ID uses OAuth 2.0 and OpenID Connect over the public internet, with tokens rather than tickets. Attacks shift accordingly: instead of Kerberoasting and pass-the-hash, the cloud equivalents are token theft, consent phishing, and application abuse. Many organizations run both in a hybrid model, and the connection between them, through Entra Connect and federation, is itself a common path attackers use to move from cloud to on-premises or back.

Related Labs

Pwned Labs Azure scenarios put you hands-on with real Entra ID attack paths, from recon to privilege escalation. Try Intro to Azure Recon with BloodHound, Abuse Dynamic Groups in Entra ID for Privilege Escalation, and Leverage Device Code Phishing for Initial Access. Browse the full set at pwnedlabs.io/explore.

Master Entra ID Security with Pwned Labs

Entra ID security is the core of Pwned Labs' Microsoft-focused training. The MCRTP (Microsoft Cloud Red Team Professional) bootcamp covers Entra ID attack techniques (password spraying, token theft, consent abuse, and privilege escalation) in live tenant environments. The MCRTE (Microsoft Cloud Red Team Expert) bootcamp goes deeper into advanced Entra ID exploitation including cross-tenant attacks, federation abuse, and application-based persistence, alongside building Sentinel detections for each technique. Explore both at pwnedlabs.io/bootcamps.

Frequently Asked Questions

What is Entra ID security?

The practice of securing Microsoft Entra ID, formerly Azure AD, against attacks such as password spraying, token theft, consent phishing, and application abuse, primarily through Conditional Access, Privileged Identity Management, and app consent controls.

What is the most common initial access technique against Entra ID?

Password spraying remains the most frequent entry point, testing common passwords across many accounts while staying under lockout thresholds, often paired with legacy authentication that bypasses MFA.

How do attackers bypass MFA in Entra ID?

Primarily through token theft. A stolen session or refresh token represents an already-authenticated session, so it bypasses MFA entirely. Adversary-in-the-middle phishing kits like Evilginx are commonly used to capture these tokens.

What is illicit consent grant abuse?

Tricking a user or administrator into granting an attacker-controlled application permissions to organizational data. Once consented, the application can access email, files, and more without needing the user's password.

What is the single most important Entra ID control?

Conditional Access is the primary defense layer. Enforcing MFA for all users, blocking legacy authentication, and applying risk-based policies closes off the most common attack paths.