Learn more about Microsoft's Secure Future and Initiative and eliminating high-privileged access across all Microsoft 365 applications.| Microsoft Security Blog
| msrc.microsoft.com
During both my DEF CON and Troopers talks I mentioned a vulnerability that existed in Azure AD where an Application Admin or a compromised On-Premise Sync Account could escalate privileges by assigning credentials to applications. When revisiting this topic I found out the vulnerability was actually not fixed by Microsoft, and that there are still methods to escalate privileges using default Office 365 applications. In this blog I explain the why and how. The escalation is still possible sinc...| dirkjanm.io
Dirk-jan’s personal blog, mostly containing research on topics I find interesting, such as (Azure) Active Directory internals, protocols and vulnerabilities.| dirkjanm.io
