Smoke and Mirrors: How to hide in Microsoft Azure

The speakers, both from With Secure, open by arguing that attackers are moving toward cloud services. They cite Microsoft's 2023 Digital Defense Report and the large volume of password spraying against Microsoft accounts. Microsoft Entra is presented as the core identity platform behind Microsoft 365 and Azure, which makes it a high-value target. They note that the new Microsoft Graph activity logs help, but do not cover everything.

The middle of the talk compares several ways of querying Entra. Listing conditional access policies through the Graph API produces a Graph activity log entry. The same request made through the legacy Azure AD Graph, the internal IAM API used by the portal, or the provisioning and app management APIs was not logged in the places they checked. The speakers explain that first-party pre-consented clients sidestep the usual admin consent requirement, and that common offensive and defensive tools rely on them. They then move to Azure Machine Learning. In a demo, a low-privileged reader used the workspace datastore pages to retrieve storage account keys and a SQL service principal secret. That principal could then read a Key Vault secret the reader could not access directly.

The closing advice is to restrict which clients can sign in, using app assignment or conditional access. Teams should prefer identity-based access over credential-based access so permissions remain auditable. Logs from several services should be combined into one analysis platform, and controls should be reassessed regularly because provider behaviour changes.