Backdooring and Hijacking Azure AD Accounts by Abusing External Identities

Overview: Dirk-jan Mollema, an independent identity security consultant and researcher from the Netherlands, presents an in-depth exploration of Azure Active Directory (Azure AD / Entra ID) external identities and B2B collaboration protocols at Black Hat. The presentation examines the mechanics of cross-tenant guest account provisioning, demonstrating how attackers can exploit default external identity configurations to hijack invitations and establish persistent backdoors into target enterprise tenants. Mollema demonstrates programmatic redemption attacks leveraging underdocumented internal API properties and exposes vulnerabilities within Azure AD identity linking workflows.

Key Topics: - Azure Active Directory (Azure AD) B2B collaboration and external identity architecture - API exploration using Microsoft Graph, Azure AD Graph, and ROADrecon - Account binding mechanisms via the alternativeSecurityIds property and netID / puid claims - Programmatic redemption of guest invitations by extracting the hidden inviteTicket property

Technical Details: Mollema establishes that while an Azure AD tenant represents an organization's primary security boundary, modern business operations frequently rely on B2B external collaboration to grant cross-tenant access to guest users. In a typical B2B workflow between a home tenant (where the user's primary account resides) and a resource tenant (the target organization hosting shared resources), an invitation link is generated and emailed to the external user. Upon clicking the link and consenting to the prompt, a corresponding guest user object is instantiated in the resource tenant. Mollema highlights that these cross-tenant invitation and redemption capabilities are enabled by default across standard Azure AD tenants without requiring specialized mutual B2B trust configurations.

To analyze the underlying identity linkage under the hood, Mollema utilizes Microsoft Graph alongside the deprecated, lower-level Azure AD Graph API, as well as his open-source auditing tool ROADrecon (part of the ROADtools framework). Inspection of Azure AD audit logs following invitation acceptance reveals that identity linkage is governed by a user attribute named alternativeSecurityIds (or altSecIds). This property stores an identity provider key containing a base64-encoded value. When decoded and converted to hexadecimal representation, this key exactly matches the external user's netID, which also corresponds to the puid (Passport Unique ID) claim embedded within the user's authentication access tokens issued by their home tenant.

Mollema reveals that the invitation redemption process can be executed entirely programmatically by issuing a direct JSON POST request to Azure AD's redemption endpoint, bypassing interactive browser-based flows. Programmatic redemption requires three parameters: the target user's netID (which can be obtained from token claims or queried in the home tenant), the invited email address, and a secret inviteTicket. Mollema discovered a critical authorization flaw: the confidential inviteTicket is stored directly as a readable attribute on the invited guest user object within Azure AD Graph. Any entity capable of querying the invited user's attributes via the API can retrieve the ticket, construct the redemption payload, and bind their own attacker-controlled netID to the guest account, successfully hijacking or backdooring the identity.

Key Takeaways: Enterprise administrators should audit default Azure AD / Entra ID external collaboration settings and restrict invitation privileges strictly to authorized administrators rather than allowing all users to invite external guests. Security teams should monitor Azure AD audit logs for anomalous alternativeSecurityIds updates, rapid guest invitation redemptions, and changes to user netID bindings. Organizations must inventory existing guest accounts using tools like ROADrecon and enforce cross-tenant access policies that restrict B2B collaboration only to trusted external tenant IDs.

(AI summary — Gemini Flash)