Azure Active Directory vs. Active Directory Domain Services

Syncing Domain Admins into Entra ID lets attackers pivot from compromised on-prem AD to the cloud, and back via password writeback. CIS and Microsoft advise keeping privileged admin accounts cloud-only.

Trail of Bits traces SAML's committee-driven origins and argues the 2002 XML-based SSO protocol should finally be retired: cursed XML signature validation keeps producing vulnerabilities, and OIDC is the way forward.

Thomas Elling demonstrates querying Active Directory through SQL Server's OLE DB ADSI provider with OPENQUERY and OPENROWSET, adding new PowerUpSQL functions that automate AD recon from SQL servers.

Releases Invoke-ExternalDomainBruteforce, which detects whether a Microsoft domain is managed or federated, picks the right authentication flow, and automates password guessing against O365 and ADFS.

A practical guide to testing SSO solutions that use SAML, covering the IdP/SP message flow and common implementation mistakes involving signatures, assertions, and message expiration.

Releases a PowerShell tool that uses Microsoft's userrealm API to enumerate ADFS federated domains, inspired by the Office365 SAML assertion vulnerability research.