I SPy: Rethinking Entra ID research for new paths to Global Admin

I SPy: Rethinking Entra ID Research for New Paths to Global Admin

Speakers: Katie Knowles

Conference: fwd:cloudsec North America 2025

YouTube: https://www.youtube.com/watch?v=oNpwtt1TEkQ

Overview

Katie Knowles, a cloud security researcher at Datadog, delivered a lightning talk dissecting the long and often frustrating history of service principal hijacking in Microsoft Entra ID (formerly Azure Active Directory). The presentation traced the attack technique from its initial disclosure in 2019 through to Knowles's own 2024-2025 research, where she demonstrated a path from Application Administrator to Global Admin by chaining service principal credential injection, domain federation abuse, and SAML token forgery -- all using one of Microsoft's own first-party applications. The talk matters because it highlights that despite years of incremental fixes, the fundamental trust model around Entra ID's application objects still harbors exploitable gaps, particularly when roles are assigned to service principals rather than users.

Background

▶ Watch: History of service principal hijacking from 2019 to present (1:30)

The story of service principal hijacking begins in 2019 when Dirk-jan Mollema published research showing that Microsoft's first-party applications could be leveraged for privilege escalation and persistence. Mollema originally reported the issue to MSRC, which initially claimed it was fixed, then reversed course and stated the behavior was "by design" -- administrators need to be able to assign credentials to local application identities for usability purposes.

By 2020, threat actors had begun exploiting general application credential abuse in the wild. The Azure team released Stormspotter, a tool for mapping service principal permissions, and a fwd:cloudsec talk by Emilia Chbuk and Christian Philippov highlighted that over 300 first-party apps existed in a default Entra tenant. By 2022, threat actors were specifically hijacking first-party Microsoft applications. Microsoft eventually introduced the App Instance Property Lock, a setting that prevents credential injection on local service principal identities when enabled by the application developer. However, Microsoft did not uniformly apply this protection to its own applications. Research by Eric Woodruff in 2024 revealed that several Microsoft first-party apps still permitted privilege escalation to Global Admin, sometimes via undocumented permissions.

Key Findings

▶ Watch: Key credentials don't synchronize between app registration and service principal (6:00)

Knowles set out to determine whether gaps remained after Microsoft's purported remediation efforts. Her research confirmed several critical findings:

First, Entra ID's application model creates a dual-object architecture -- an application registration (the definition) and a service principal (the identity). These two objects share an Application ID but diverge significantly in other properties. Crucially, the key credentials and password credentials properties exist independently on both objects with no synchronization, meaning a credential added to either grants the ability to authenticate as the application.

Second, credentials added to service principals are invisible in the Entra portal, making backdoor persistence via service principal credential injection particularly stealthy. Actions taken with these credentials appear in logs as the application, not as the attacker.

Third, Knowles was able to add a certificate to the Office 365 Exchange Online service principal and authenticate as that application. The token returned included the Domain.ReadWrite.All permission, which she leveraged to execute a full domain federation attack.

Fourth, the escalation path from Application Administrator to Global Admin worked when the role was assigned to a service principal but not when assigned to a user -- a quirk that MSRC confirmed and dismissed as an edge case not warranting a fix.

Technical Deep Dive

▶ Watch: Certificate injection via PATCH request to service principal (10:00)

Knowles's methodology was methodical and API-driven. She deliberately worked with Microsoft Graph REST APIs directly rather than PowerShell or Azure CLI to understand the underlying object model at the lowest level.

Step 1 -- Secret Injection: She attempted to inject secrets into all Microsoft first-party service principals via a POST request to the /addPassword endpoint. Of roughly 500 applications in her default tenant, only a handful accepted credentials. Many returned errors indicating that certificates were required instead.

Step 2 -- Certificate Injection: For applications that rejected secrets, she used a PATCH request to directly modify the service principal object, injecting a Base64-encoded certificate into the keyCredentials property. This bypassed the addKey endpoint's requirement to prove possession of an existing certificate.

Step 3 -- Token Acquisition via Client Assertion: Authentication with a certificate required constructing a custom JWT containing the certificate thumbprint and exchanging it with Entra ID's token endpoint using the client_credentials OAuth flow. The resulting access token revealed the application's assigned scopes and Entra ID roles (visible in the wids claim).

Step 4 -- Domain Federation Attack: The token for the Office 365 Exchange Online service principal included Domain.ReadWrite.All. Knowles used this to add an attacker-controlled external domain, verified DNS ownership, then created a federation configuration with a certificate she controlled. This certificate was now trusted to issue SAML tokens for any synchronized user in the tenant.

Step 5 -- SAML Token Forgery: Using AADInternals, she retrieved the target user's ImmutableID (the Base64-encoded on-premises GUID) via the Microsoft Graph API, then forged a SAML token with MFA claims included. Exchanging this token with Microsoft's login services granted full access as the targeted Global Admin across M365, Azure Portal, and all SSO-integrated services.

Demo / Proof of Concept

▶ Watch: Live demo: backdooring Office 365 Exchange Online service principal (12:00)

Knowles performed a live demonstration showing the end-to-end chain: injecting a certificate into the Office 365 Exchange Online service principal, obtaining a token, adding an external domain, configuring federation, and forging a SAML token to escalate to Global Admin. The demo confirmed that the attack worked when the Application Administrator role was assigned to a service principal. She also showed the decoded JWT revealing the application's scopes and Entra ID role assignments.

Defensive Implications

▶ Watch: MSRC response: edge case due to service principal role assignment (16:30)

Defenders should take several concrete actions in response to this research. First, enable the App Instance Property Lock on any custom applications published for external consumption -- this prevents credential injection on local service principal identities. Second, audit service principal credential assignments through the Microsoft Graph API, since the Entra portal does not surface credentials added to service principals. Third, monitor for domain federation changes and new domain additions via audit logs, as these are high-fidelity indicators of this attack chain. Fourth, restrict the Application Administrator role and avoid assigning it to service principals where possible. Fifth, treat first-party Microsoft applications with the same suspicion as third-party applications when assessing trust boundaries. Finally, organizations should recognize that Microsoft's documentation still describes this behavior as "by design" even as they quietly implement mitigations, creating a dangerous gap between documented and actual security posture.

Key Takeaways

• Service principal hijacking has been a known issue since 2019, and despite incremental fixes, exploitable gaps persist in Microsoft's first-party applications
• Entra ID's dual-object model (app registration vs. service principal) creates credential injection opportunities that are invisible in the portal
• The Office 365 Exchange Online service principal can still be backdoored (with certificate auth) when the attacker holds Application Administrator as a service principal role assignment
• Domain federation abuse allows forging SAML tokens as any synchronized user, including Global Admin, with MFA bypass
• MSRC classified this finding as a non-issue because it requires the role to be assigned to a service principal rather than a user -- a meaningful but narrow distinction
• Building off existing community research and approaching problems incrementally is an effective methodology for security researchers at any experience level

About the Speaker(s)

Katie Knowles is a cloud security researcher at Datadog, where she focuses primarily on Azure and Entra ID security research. She began her dedicated research role approximately a year before this talk and credits the fwd:cloudsec community and colleagues like Dan Gerlock for encouraging her to build on existing research rather than seeking entirely novel findings. She emphasizes that methodical thinking and thorough note-taking are more important than natural hacking talent.