Breaking Entra: Identity Attacks You Can Recreate | Jonathan Elkabas

Identity Is Not the Whole Perimeter

Jonathan Elkabas argues “identity is the new perimeter” understates the problem: buying credentials bypasses technical controls, and non-human identities dominate modern tenants. Microsoft reports far more workload identities than human users, many over-permissioned.

Entra Identity Sprawl

He breaks down service principals behind enterprise apps, system- and user-assigned managed identities for Azure resources, and newer agent identities tied to Copilot and AI services—calling the overlapping terminology organized confusion attackers exploit.

Midnight Blizzard Case Study

The talk revisits APT29’s Microsoft breach starting from password spray against a legacy test tenant and escalating to executive email access, illustrating how minor misconfigurations chain into tenant compromise.

Entra Goat Lab

Elkabas introduces Entra Goat, a deliberately vulnerable Entra ID environment for safely practicing attack paths end to end. The session demos misconfiguration chains attackers use in the wild and encourages hands-on recreation in isolated labs.