EntraGoat Scenario 6: Exploiting Certificate-Based Authentication to Impersonate Global Admin in Entra ID

EntraGoat Scenario 3: how group ownership, role-assignable groups and service principal management chain from a low-privileged user to Global Administrator — plus detection and defense guidance.

SyncJacking: how attackers can abuse Entra Connect hard matching to take over synchronized Entra ID accounts, including Active Global Administrators — and how to detect and mitigate it.

EntraGoat Scenario 2: a certificate leaked through CI/CD artifacts leads to app-only Graph permission abuse — self-assigning RoleManagement.ReadWrite.Directory and resetting the Global Admin password.

EntraGoat Scenario 1: a compromised low-privileged finance user who owns a privileged enterprise application adds a client secret, pivots into app-only context and takes over the Global Administrator.

A quick-start guide to EntraGoat: test tenant, Node.js and PowerShell 7 prerequisites, cloning the lab, launching your first challenge, capturing flags and cleaning up afterwards.

Semperis found Microsoft app permissions in Entra ID could act beyond intended authorization—even adding users to Global Administrator. Fixed via MSRC; covers detecting prior abuse and hardening.