PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Auditing Application Permissions in Microsoft Entra ID: Hidden Risks, Pitfalls, and Quarkslab's QAZPT Tool

blog.quarkslab.com | research | #cloud-security | #active-directory | #entra-id | #azure | #tooling | #oauth | #permissions
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Quarkslab explains why auditing Microsoft Entra ID app permissions is hard — inheritance via ownership, groups and federation hides effective privileges — and introduces its open-source QAZPT tool.
Published
Collected

Related coverage

research · semperis.com
UnOAuthorized: Privilege Elevation Through Microsoft Applications
Semperis found Microsoft app permissions in Entra ID could act beyond intended authorization—even adding users to Global Administrator. Fixed via MSRC; covers detecting prior abuse and hardening.
blog · projectblack.io
Should I Azure AD Sync/Entra Cloud Sync Domain Admins?
Syncing Domain Admins into Entra ID lets attackers pivot from compromised on-prem AD to the cloud, and back via password writeback. CIS and Microsoft advise keeping privileged admin accounts cloud-only.
blog · semperis.com
Practice Checkpoint 2: Setting Agent Identity Permissions
Semperis practice checkpoint two wires up the Entra ID agent permission model: direct app-only roles on the agent identity plus inheritable delegated permissions granted at the blueprint level.
blog · wiz.io
3 OAuth TTPs Seen This Month — and How to Detect Them with Entra ID Logs
Three OAuth techniques attackers use in Azure, and how Entra ID sign-in logs and JWT claims expose them; includes Wiz telemetry on prevalence and ready-to-use KQL detection queries.
blog · semperis.com
A New App Consent Attack: Hidden Consent Grant
Semperis found Entra ID's Directory.ReadWrite.All permission can be abused to escalate privileges, disrupt services, or take over a tenant—the Hidden Consent Grant attack, rated potentially severe.
blog · semperis.com
Top Security Risks to Watch for in Shifting to Hybrid Identity Management
As enterprises integrate Microsoft Entra ID (formerly Azure AD) with on-prem AD, this piece examines hybrid identity risks—above all permission sprawl—and urges a look-before-you-leap approach to cloud identity adoption.
Back