Entra-Id on CuraSec

Auditing Admin Rights in Microsoft Entra ID

Thu, 27 Aug 2026 21:01:55 +0000

Engineer — Plan: Run an Entra ID privileged role audit this quarter: export current role assignments, flag stale accounts from departed staff, and scope down over-provisioned roles (e.g. helpdesk accounts holding Global Admin) to least-privilege equivalents.
SOC/IR — Learn: Useful framing for why excessive Entra admin roles expand blast radius during identity-based intrusions, but no new TTPs, IOCs, or detection content here.
Leader — Plan: Excess admin accounts are a recurring audit finding (CIS Control 4); scheduling a formal privileged-access review and documenting results strengthens posture for SOC 2 / ISO 27001 auditors asking exactly this question.

Fri, 21 Aug 2026 11:38:25 +0000

Engineer — Act: Microsoft has applied a server-side fix requiring no customer patch, but active exploitation occurred before remediation — audit Entra ID sign-in and audit logs for anomalous authentication, new service principals, or privilege escalation events from the period prior to the fix, and verify no credential or token abuse persists.
SOC/IR — Act: Confirmed in-the-wild exploitation of an identity provider with a public PoC warrants an immediate hunt — query Entra ID audit and sign-in logs for suspicious app registrations, delegated permission grants, and admin role assignments occurring in the exploitation window, and tune detections for anomalous OAuth consent flows.
Leader — Act: A CVSS 10.0 actively exploited RCE on the organization’s cloud identity plane is a board-level event analogous to Log4Shell in blast radius — brief leadership this week on the pre-patch exposure window and confirm with the security team that no evidence of compromise was found in Entra ID logs before Microsoft’s server-side fix landed.
Signals: CVE-2026-69836 — CISA KEV: not listed, EPSS n/a, public PoC on GitHub

Fri, 21 Aug 2026 11:38:25 +0000

Engineer — Act: Max-severity flaw in Microsoft Entra ID with confirmed active exploitation makes this immediate-action territory regardless of missing EPSS/KEV signals. Apply Microsoft’s Entra ID patch now and review sign-in and audit logs for anomalous authentication activity around and before the disclosure date.
SOC/IR — Act: Active exploitation of an IAM platform means compromise may have already occurred in unpatched environments. Hunt for anomalous Entra ID authentication events (unexpected sign-ins, token grants, role assignments) and check whether Microsoft has published associated IOCs or TTPs to tune detections.
Leader — Act: Entra ID underpins identity for the vast majority of enterprise environments, and confirmed active exploitation of a maximum-severity flaw is a board-question-level event. Confirm patching status with your engineering team this week and be ready to brief leadership before customers or auditors raise it.

Fri, 21 Aug 2026 11:38:25 +0000

Engineer — Learn: Practical walkthrough on using MS Graph and PowerShell to surface Entra ID risk detections — useful reference if you’re building automated triage or identity monitoring pipelines.
SOC/IR — Plan: Walk through the MS Graph risk-detection commands shown here and consider incorporating them into your Entra ID hunting runbooks or SIEM enrichment workflows.
Leader — Skip

Fri, 21 Aug 2026 11:38:25 +0000

Engineer — Learn: Practical scripting technique for auditing MFA coverage gaps in Entra ID using Microsoft.Graph.Beta PowerShell; useful reference when validating rollout completeness but no vulnerability or patch action required.
SOC/IR — Skip
Leader — Skip

Fri, 21 Aug 2026 11:38:25 +0000

Engineer — Learn: Practical reminder that cloud identity login logs (Entra ID sign-in logs) deserve the same daily scrutiny as on-prem logs; useful if you haven’t wired these into a monitoring workflow yet, but no patch or config change required.
SOC/IR — Plan: Adopt or adapt the PowerShell queries shown to pull Entra successful/failed login data for routine password-spray hunting; worth scheduling as a log-source coverage improvement if Entra sign-in logs aren’t already feeding your SIEM.
Leader — Skip

Fri, 07 Aug 2026 11:54:55 +0000

Engineer — Plan: This post-exploitation technique lets malware silently leverage WHfB keys to register attacker-controlled devices and obtain PRTs in Entra ID tenants. Audit Conditional Access policies to enforce device compliance checks for sensitive operations and restrict who can register new devices in your tenant.
SOC/IR — Plan: The technique has a clear Entra ID audit-log surface: build detections on anomalous device registrations and PRT issuances in Microsoft Entra sign-in and audit logs, particularly where the registering session doesn’t match expected device inventory.
Leader — Learn: Published research reveals a persistence path through Microsoft’s cloud identity stack that could let an endpoint compromise extend into long-lived Entra ID access; no active exploitation or breach is reported, so no immediate leadership action is needed.

Tue, 14 Jul 2026 12:08:08 +0000

Engineer — Plan: This is a breaking change to default authentication behavior in Entra ID — audit your tenant’s authentication policy, test passkey rollout for user flows, and review the updated SMS/voice auth model before it affects production sign-ins.
SOC/IR — Learn: Passkey adoption changes the phishing-resistant auth landscape and may affect credential-based attack detections; no immediate hunt or detection work required, but worth understanding how login telemetry shifts.
Leader — Plan: A platform-level auth default change from a major identity provider warrants a quarter-horizon review of helpdesk readiness, user communication plans, and any compliance attestations tied to MFA method specifics.