Staying Sneaky in Microsoft Azure

The talk looks at how a tester or attacker can enumerate a Microsoft Entra ID and Azure tenant while avoiding the logs defenders usually watch. The speaker starts from the gap that calls to Microsoft Graph now appear in Graph activity logs, which makes tools such as AzureHound noisy, while some internal, portal-facing APIs do not pass through Graph and leave no comparable record.

He then walks through several of these endpoints. One returns the caller's effective permissions in a single request, another lists users in large batches, and others expose conditional access policies and role assignments for a given user. A clear example involves a privileged group that appeared empty through the standard group query. Querying Privileged Identity Management for groups revealed five eligible members, because just-in-time access hides people who are not currently active.

The closing advice is that this logging gap is a reason to layer detections rather than chase full coverage. Defenders should alert on changes to privileged role assignments and group membership, use endpoint telemetry, restrict access by IP range or managed device, and shorten sign-in frequency and token lifetimes so that stolen sessions must keep being renewed. He also suggests treating the deprecation of Azure AD Graph as a chance to research further undocumented APIs.