RomHack 2025 - Dr Nestori Syynimaa - The Ultimate Guide for Protecting Hybrid Identities in Entra ID

### Overview In this presentation, Dr. Nestori Syynimaa explores attack paths and defense mechanisms surrounding hybrid identities bridging on-premises Active Directory environments and Entra ID (formerly Azure AD). While Microsoft's 2024 threat intelligence indicates that 99% of observed attacks are password-based, the remaining <1%—representing infrastructure compromise—poses a critical threat because attackers breaching on-premises hybrid components can log in directly as trusted entities. Grounded in graph theory and the tenet that "defenders think in lists, attackers think in graphs," the talk models the trust relationships, stored credentials, and exploitation techniques across five core hybrid architectures, providing concrete administrative mitigations.

### Key Topics The session analyzes five primary hybrid authentication and synchronization architectures: 1. **Entra Connect Sync**: Examining the exposure of synchronized accounts, administrative web service protocols, and the risks of credential extraction. 2. **Entra Cloud Sync**: Evaluating the lightweight provisioning agent model, certificate-based authentication, and bootstrap renewal mechanisms. 3. **Pass-through Authentication (PTA)**: Assessing agent-based authentication validation against on-premises Active Directory. 4. **Federated Identity (ADFS)**: Dissecting token-signing certificates, trust exploitation, and cross-domain token manipulation. 5. **Exchange Hybrid**: Reviewing service principals, actor tokens, offline impersonation tokens, and Exchange Web Services access.

### Technical Details - **Entra Connect Sync**: Connect synchronizes on-prem objects to Entra ID using either a user account or an application identity. If an attacker gains local administrator access, they can extract the synchronization credentials (demonstrated live using Syynimaa's `AADInternals` toolkit via `Get-AADIntSyncCredentials`). When application certificates are stored on disk, admins can read the private key. Storing private keys in TPM/HSM restricts signing to the host; however, research from SpecterOps (Daniel Heinsen) revealed that an attacker with local signing privileges can add a new credential to the cloud application to gain persistent offline access. Attackers with synchronization secret access can also exploit soft-match and hard-match features in the Admin Web Service (AWS) to convert cloud-only objects into synchronized objects, enabling unauthorized password resets. - **Entra Cloud Sync & Pass-Through Authentication (PTA)**: Cloud Sync and PTA utilize an on-premises provisioning agent authenticated via certificate-based authentication to the hybrid identity service. The certificate (valid for roughly 90 days) is automatically renewed via an on-premises bootstrap service every 10 minutes. If compromised, an attacker can contact the bootstrap service offline to renew certificates. Deleting the agent locally leaves cloud records intact; tenant administrators must disable the sync user account, disable PTA in the cloud, or contact Microsoft support to remove lingering agents (which otherwise remain active for up to 10 days of inactivity). - **ADFS & Federated Identity**: Entra ID trusts authentication tokens signed by the identity provider's certificate based on the `ImmutableID`. Default managed certificates are stored in configuration databases and encrypted, but can be decrypted by local administrators using tools like `AADInternals` (`Export-AADIntAdfsCredentials`). An attacker who acquires the signing certificate can forge tokens for any user across federated or even managed domains within the tenant if immutable ID validation matches without strict domain trust constraints. Storing custom certificates in a Hardware Security Module (HSM) prevents private key export. - **Exchange Hybrid**: Exchange Hybrid relies on credentials attached to the Office 365 Exchange Online service principal. Compromising the local Exchange server allows administrators to obtain an *actor token*. Attackers can subsequently generate an offline *impersonation token* containing the actor token to impersonate any user (including Global Admins) via Exchange Web Services (EWS).

### Takeaways - **Tier 0 Designation**: All servers hosting hybrid identity components (Entra Connect, Cloud Sync agents, PTA agents, ADFS, and Exchange Hybrid) must be treated and protected with the same rigor as Tier 0 assets (like Domain Controllers). - **Credential & Key Protection**: Shift away from user credentials to application-based identities. Where certificates are utilized, use custom certificates stored securely in TPM or HSM to limit offline export. - **Feature Hardening**: Disable soft matching and hard matching unless actively migrating users to prevent cloud object takeover. - **Exchange Migration**: Transition away from legacy shared Exchange Online identities to dedicated Exchange Hybrid application identities, and restrict trust settings across federated domains.