Advanced Active Directory to Entra ID Lateral Movement Techniques

Advanced Active Directory to Entra ID Lateral Movement Techniques

Speakers: Dirk-jan Mollema

Conference: DEF CON 33

YouTube: https://www.youtube.com/watch?v=rzfAutv6sB8

Slides: https://media.defcon.org/DEF%20CON%2033/DEF%20CON%2033%20presentations/Dirk-jan%20Mollema%20-%20Advanced%20Active%20Directory%20to%20Entra%20ID%20lateral%20movement%20techniques.pdf

Overview

Dirk-jan Mollema, founder of Outsider Security, presented new and advanced techniques for lateral movement from an on-premises Active Directory (AD) environment to Microsoft Entra ID (formerly Azure Active Directory) in hybrid environments. Building on existing published research about hybrid attacks, the talk introduced novel attack paths involving Entra ID policies and Exchange hybrid configurations that allow a domain-level attacker with full on-premises control to extend that compromise into the cloud tenant. The presentation is aimed at red teamers, penetration testers, and defenders who need to understand the full scope of what "domain compromise" means in hybrid environments where cloud workloads are increasingly sensitive.

Background

▶ Watch: Um if that's a little vague, we'll get into that. (0:46)

Hybrid identity environments — where an on-premises Active Directory domain is synchronized to Microsoft Entra ID via Microsoft Entra Connect (formerly Azure AD Connect) — are the dominant enterprise configuration for Microsoft identity infrastructure. Organizations synchronize on-premises identities to the cloud to provide single sign-on for both on-premises and cloud applications.

The existing threat model for hybrid environments was already established: an attacker with domain admin on-premises can abuse the Entra Connect sync service to forge cloud credentials, can use the AD FS service to impersonate cloud users, and can leverage other configuration-dependent paths. Mollema acknowledged this prior research and moved past it, focusing on attack paths that work even when these specific configurations are absent or hardened.

The motivation is straightforward: most organizations have migrated significant resources and applications to Entra ID and Azure. An attacker who has achieved full on-premises AD compromise but cannot extend to the cloud has less valuable access than one who can also compromise cloud identities, Azure subscriptions, and cloud-hosted applications. Understanding the lateral movement paths is essential for accurate red team scope assessment and for defenders to understand what must be protected when on-premises AD is a risk.

Key Findings

▶ Watch: Um but what you can also do is add them to a microsoft.com domain. (18:05)

• Policy-based lateral movement: New attack paths leverage Entra ID Conditional Access Policies and Authentication Policies that are configured in ways that can be exploited from a compromised on-premises position.
• Exchange hybrid lateral movement: Microsoft Exchange hybrid deployments create a specific and underappreciated attack path from on-premises to Entra, distinct from the Entra Connect attack path.
• Entra Connect attribute manipulation remains a powerful attack path and is expanded upon with new techniques for less obvious attribute abuses.
• New tools were released to support the demonstrated attack paths, extending the capabilities of existing tools like ROADtools.
• The lateral movement techniques work against default configurations — not just misconfigured environments — making them broadly applicable.

Technical Deep Dive

▶ Watch: And actually, today we're going to extend that attack service to the cloud. (22:43)

The hybrid attack model:

The starting assumption is full on-premises Active Directory compromise (Domain Admin) in an environment where on-premises AD is synchronized to Entra ID via Entra Connect. The attacker's goal is to achieve persistent, high-privilege access in Entra ID and the broader Azure tenant.

Entra Connect sync abuse (existing baseline):

The Entra Connect sync service uses a privileged Entra ID account to write synchronized attributes from on-premises AD to the cloud. With Domain Admin access, an attacker can extract the credentials for this sync account and use them directly in Entra ID with full sync-level permissions. This is well-understood prior work.

New technique 1: Policy-based lateral movement via Authentication Strength Policies:

Entra ID Conditional Access Policies can require specific authentication strengths for access to cloud resources. In hybrid environments, it is possible to configure authentication methods that rely on on-premises components (such as Certificate-Based Authentication using on-premises PKI, or Windows Hello for Business with on-premises trust).

Mollema demonstrated that an attacker with on-premises domain control can issue certificates from the on-premises PKI that satisfy cloud authentication strength requirements, effectively using the on-premises CA as a bridge to cloud authentication. This requires that the organization has configured cloud trust for on-premises certificate-based authentication — a configuration that is common in enterprise hybrid deployments.

The specific attack involves:

1. Identifying that Entra ID Conditional Access accepts certificates signed by the on-premises enterprise CA
2. Using ADCS (Active Directory Certificate Services) — already compromised with domain admin — to issue certificates for arbitrary Entra ID user identities
3. Using those certificates to authenticate to Entra ID as any user, including Global Administrators

New technique 2: Exchange hybrid lateral movement:

Exchange hybrid deployments use a special privileged relationship between on-premises Exchange and Exchange Online (part of Microsoft 365). This relationship exists to enable features like shared address books, calendar federation, and mail flow between on-premises and cloud mailboxes.

Mollema disclosed that this Exchange hybrid trust relationship can be abused by an on-premises attacker to perform actions in Exchange Online that a normal on-premises admin could not perform. The specific mechanism involves the EWS (Exchange Web Services) impersonation capability that Exchange hybrid deployments configure between on-premises and cloud:

1. Exchange hybrid creates a service account in Exchange Online with elevated Exchange permissions
2. The credentials or access tokens for this account are stored on-premises (in the Exchange servers)
3. With on-premises domain admin, an attacker can extract these credentials
4. Using these credentials in Exchange Online provides access to Exchange Online mailboxes and management capabilities

This gives the attacker access to all Exchange Online mailboxes without Entra Global Admin — a different privilege path that may bypass some monitoring focused on Entra-level admin operations.

New technique 3: Entra Connect attribute abuse — ImmutableID manipulation:

The ImmutableID attribute (also known as onPremisesImmutableId in Entra ID) links an on-premises AD user object to its cloud counterpart. By manipulating this attribute via the Entra Connect sync service, an attacker can:

• Orphan a cloud account from its on-premises counterpart by changing the ImmutableID
• Hijack a cloud account by setting the ImmutableID of an on-premises account to match an existing cloud-only account, forcing a sync merge that links the cloud account to the on-premises identity (and thus to the attacker's control)

The ImmutableID merge technique specifically targets cloud-only Entra ID accounts that were never synchronized from on-premises — accounts like cloud-native service principals, break-glass admin accounts, and Entra-native automation identities. These accounts are sometimes treated as outside the blast radius of on-premises compromise, which this technique disproves.

Tooling: Mollema extended ROADtools (his existing Entra ID research toolkit) and released new scripts to enumerate the hybrid configuration, identify applicable attack paths, and execute the demonstrated techniques.

Demo / Proof of Concept

▶ Watch: Um I think this should never exist in the first place. (31:46)

The talk included live demonstrations:

• Certificate-based authentication lateral movement: issuing a certificate from an on-premises CA and using it to authenticate as an Entra Global Administrator
• Exchange hybrid credential extraction from an on-premises Exchange server and subsequent access to Exchange Online mailboxes
• ImmutableID manipulation: creating an on-premises account, setting its ImmutableID to match a cloud-only account, forcing a sync, and demonstrating that the cloud-only account is now under on-premises attacker control

All demonstrations used lab environments representative of production hybrid configurations.

Defensive Implications

▶ Watch: Just finding our newly created global admin. (36:16)

Understand that on-premises Domain Admin implies Entra ID risk. In most hybrid environments, full on-premises AD compromise should be treated as equivalent to partial or full Entra ID compromise. Security operations and incident response plans should reflect this.

Audit ADCS for cloud trust. Review whether any on-premises Certificate Authorities are trusted by Entra ID for cloud authentication. If certificate-based authentication is not required, remove the trust. If it is required, monitor certificate issuance from these CAs and alert on certificates issued for cloud-privileged identities.

Review Exchange hybrid permissions. Audit the service accounts and permissions created by Exchange hybrid configuration. Restrict these accounts to minimum required permissions and monitor their activity in both on-premises and Exchange Online audit logs.

Protect Entra Connect sync accounts. The sync service account in Entra ID should be treated as a Tier-0 asset equivalent to Domain Admin. Monitor its activity continuously and alert on any authentication or use outside of expected patterns.

Monitor ImmutableID changes. Changes to the ImmutableID/onPremisesImmutableId attribute should be logged and reviewed. Unexpected ImmutableID changes — particularly those affecting cloud-only or privileged accounts — are a strong indicator of attack.

Break-glass and cloud-only admin accounts are not safe from on-premises compromise in most hybrid configurations. Consider maintaining a completely separate, non-hybrid Entra tenant for the most privileged administrative identities.

Key Takeaways

1. Hybrid AD/Entra environments have lateral movement paths from on-premises to cloud that extend beyond the well-known Entra Connect sync abuse.
2. On-premises PKI trusted by Entra ID for certificate-based authentication is an on-premises-to-cloud bridge that domain-level attackers can exploit to authenticate as cloud admins.
3. Exchange hybrid deployments create privileged service accounts with Exchange Online access whose credentials are stored on-premises and extractable by domain admins.
4. ImmutableID manipulation enables domain-level attackers to take over cloud-only Entra accounts, including break-glass admin accounts thought to be outside on-premises blast radius.
5. In most hybrid environments, a fully compromised on-premises AD should be treated as a fully compromised Entra ID tenant.
6. New tooling from ROADtools extended the practical applicability of these attack paths for red teams and penetration testers.

About the Speaker(s)

▶ Watch: Um actually there's also a mitigation plan for this. (39:41)

Dirk-jan Mollema is the founder of Outsider Security, where he conducts a mix of security research, consultancy, and training. He is the author of ROADtools, a widely used toolkit for Entra ID and Azure research. He is one of the most recognized researchers in the Microsoft identity security space, with previous work covering Kerberos delegation, Azure AD lateral movement, and numerous Active Directory attacks. He writes regularly on his blog (dirkjanm.io) about identity security research.