This is the fourth and final post in a 4-part blog series that accompanies ERNW White Paper 80: Token Theft in Microsoft Entra ID - An Analysis of Controls. In Part 1, we covered how attackers steal tokens, Part 2 looked at Continuous Access Evaluation, and Part 3 tested Token Protection. This post steps back from individual defenses and looks at the standards underneath them: how closely does Entra ID’s OAuth 2.0 implementation follow the specifications and best practices, where does it deviate, and what is the practical security impact of those deviations?
Continue reading Continue readingEntra ID
Token Theft in Microsoft Entra ID (Part 3 of 4): Token Protection
This is the third post in a 4-part blog series that accompanies ERNW White Paper 80: Token Theft in Microsoft Entra ID - An Analysis of Controls. In Part 1, we covered how attackers steal tokens, and Part 2 looked at Continuous Access Evaluation. This post covers Microsoft’s defense, Token Protection: how it binds tokens to a device, and where that binding can be bypassed.
Device-Bound Refresh Tokens: The Core Idea
Microsoft wants to protect against token replay, where an attacker steals a token and simply presents it again from their own machine. Refresh tokens are the most attractive target for this. Compared to access tokens, which are only valid for a short time, refresh tokens live much longer and can be redeemed for new access tokens again and again. A single stolen refresh token therefore gives an attacker long-lasting access and a way to maintain persistence, even after the original access token has expired.
Continue reading Continue readingToken Theft in Microsoft Entra ID (Part 2 of 4): Continuous Access Evaluation
This is the second post in a 4-part blog series that accompanies ERNW White Paper 80: Token Theft in Microsoft Entra ID - An Analysis of Controls. In Part 1, we covered how attackers steal tokens in the first place. This post digs into Continuous Access Evaluation, the event-driven mechanism Entra ID adopted to help close that gap.
Continue reading Continue readingToken Theft in Microsoft Entra ID (Part 1 of 4): Threat Landscape and Attack Techniques
This is the first post in a 4-part blog series that accompanies ERNW White Paper 80: Token Theft in Microsoft Entra ID - An Analysis of Controls. Over the next four posts, we’ll walk through how token-based attacks work, put important Microsoft defenses gaining relevance in this context, Continuous Access Evaluation and Token Protection, through empirical testing, and check where Entra ID still deviates from OAuth 2.0 best practices. This post sets the stage: why token theft matters, and how attackers actually get their hands on a token.
Continue reading Continue readingERNW White Paper 80: Token Theft in Microsoft Entra ID - An Analysis of Controls
While most attacks against cloud identities still rely on traditional password-based techniques, such as password spraying, credential stuffing, and brute-force attacks, these methods have become less effective as multi-factor authentication (MFA) has become more widespread. As a result, attackers are increasingly turning to token-based techniques, including token theft, adversary-in-the-middle (AiTM) attacks, device code phishing, and ConsentFix, which get around MFA instead of trying to break it.
As one of the most widely deployed identity platforms, Microsoft Entra ID is a prime target for these evolving attack techniques. This raises the question: how well does its defense-in-depth strategy actually hold up against this shift? We put it to the test.
Continue reading Continue reading#TROOPERS26 AD & Entra ID Security Track
The #TROOPERS26 ‘AD & Entra ID Security’ track delivered an incredible experience – much like the entire conference! We were thrilled to host some of the brightest minds in identity research alongside a highly engaged audience who brought valuable insights to the roundtable discussions. While the presentation slides have already been published on the TROOPERS website, several speakers have shared complementary tools, in-depth blog posts, and active social media threads. To make things easy, we’ve compiled a comprehensive list of all these fantastic resources from the track below.
Continue reading Continue readingInsights into Entra ID’s (Un)Conditional Access
When looking at security measures in Microsoft Entra ID environments, a common recommendation is to implement Conditional Access policies.
Whether Conditional Access is implemented can be quickly checked, and you can put a check mark next to it in your best-practice compliance form. However, simply implementing conditional access will not provide much security. A phishing attack that we recently analyzed highlights this very well.
Continue reading Continue reading#TROOPERS25 AD & Entra ID Security Track
The #TROOPERS25 ‘AD & Entra ID Security’ track was a blast – as was the whole conference 😉 – bringing together some of the smartest researchers in the field and a great audience of practitioners willing to share their experiences during the roundtable. The slides of the talks have been released in the interim on the TROOPERS website, but since many speakers published additional blogposts or released tools, we provide a compilation of resources from the track in the following.
Continue reading Continue reading