Correct: a. Just-in-time admin.

Microsoft · Azure security · Lesson 9 of 10

Attack path: identity is how they walk in

Nobody “hacked the NSG.” They phished a refresh token, found an app registration secret in Git, or used standing Owner on sub-spoke-app. The packet path was fine. The identity path was a hallway with no doors. PIM makes admin eligible, not permanent. CA and Key Vault do not help if Owner is a personal account that never expires.

Updated 2026-08-18·18 min read·L2 primary·Quiz at end

After this page you can

Draw three dummy attack paths that never touch the Firewall.
Replace standing Owner with PIM-eligible groups.
Hunt app registration credentials and stale refresh tokens.
Prove with Entra sign-in + audit + role assignment, not a port scan.

The ticket

pay-api disk is encrypted. NSG is tight. Firewall logs are clean. A guest created a new Owner assignment at 03:11 from an unfamiliar refresh-token replay. Defender secure score did not move. Sentinel is empty because nobody connected Entra.

Quick interview answer

Modern Azure intrusion is usually an identity path: phished password or MFA fatigue, stolen refresh token / PRT, over-privileged Owner / User Access Administrator, or a leaked app registration client secret. Network controls never see it. Mitigations: CA + phishing-resistant MFA, token protection / continuous access evaluation where you have it, no standing admin (PIM eligible + MFA + reason + time-box), no secrets in Git (lesson 5), break-glass monitored (lesson 4), Sentinel on SigninLogs and AuditLogs (lesson 7). Hunt the directory, not only the VNet.

Identity attack path around the Azure Firewall — The Firewall never received a packet. The directory did.

Lab data · dummy only

Tenant techclick-lab.in · MG tc-root / tc-landing / tc-workloads · subs sub-hub sub-spoke-app · hub VNet 10.40.0.0/16 · spoke 10.41.0.0/16 · Azure Firewall 10.40.0.4 · VPN GW public 203.0.113.50 · on-prem FortiGate WAN 203.0.113.10. Not a live tenant.

Mental model

Path	What they stole	What they become
User	Password / refresh token / PRT	Priya, then whatever roles she has
Standing RBAC	Nothing — it was already granted	Owner on `sub-spoke-app` forever
Workload identity	App registration client secret	The app, with Graph or ARM rights

Around the Firewall

If your only sensor is Firewall network rules, this path is silent.

How to choose

Privilege	Do	Do not
Subscription Owner	PIM eligible on a group, activate for hours	Standing Owner on a Hotmail
Global Admin	Two people, PIM, monitored	Daily mail in that role
App auth	Managed identity / federated credential	Client secret in Git for years

https://portal.azure.com

Training mock · not live

Azure portal

HomeMicrosoft Entra IDVirtual networksAzure Firewall

Microsoft Entra ID → Privileged Identity Management

Azure resources · sub-spoke-app

Role

Owner

Assignment type

Eligible · group wl-owners

Activation

MFA + reason + 4 hours · dummy

Standing Owner on personal ID

None — removed

App registrations with secrets

0 active · MI used by pay-api

PIM eligible, not standing. Training mock.

Runbook

Side A — assignments
az role assignment list on sub-hub and sub-spoke-app. Kill standing Owner/User Access Administrator on personal users. Move to groups + PIM.
Side B — apps + tokens
Entra → App registrations → Certificates & secrets. Expire or delete unused secrets. Prefer MI (lesson 5). Review sign-ins with unusual refresh-token / unfamiliar client.
Side C — prove
Activate Owner via PIM in the lab, do the change, let it expire. Sentinel rule on PIM activations + bg-emergency. No new standing assignment remains.

az · dummy

az role assignment list --subscription sub-spoke-app --include-inherited -o table
# Principal                         Role     Type
# wl-owners                         Owner    Group   (make this PIM eligible)
# priya@techclick-lab.in            Reader   User

az ad app list --all --query "[].displayName" -o tsv
# pay-api-old   # retire its client secret

az monitor activity-log list --offset 1d --query "[?contains(operationName.value, 'roleAssignments')].operationName.value" -o tsv
# Microsoft.Authorization/roleAssignments/write

Four failures

1 · Standing Owner

The token only has to be stolen once. It keeps working.

2 · App secret in Git

Rotate is not optional. Assume it is already being used.

3 · Firewall-only detection

Identity path never hits 10.40.0.4.

4 · Guest with User Access Administrator

They can mint Owner. That is the path.

How to prove it

Close only when

1) No standing Owner on a personal ID. 2) App secrets are gone or dated. 3) Entra logs are in the workspace. 4) You can narrate the path without mentioning a port.

Traps

Comfortable lie	Fix
We have MFA, so tokens are safe	Refresh tokens / session replay still exist — CA + device + PIM
Reader cannot hurt us	True until they also have an app secret with Graph write
PIM is licensed later	Then you still remove standing Owner. Delay is not a design.

Azure security class series: Shared + Entra · Landing zone · NSG vs Firewall vs WAF · Conditional Access · Key Vault + MI · Private Link · Defender + Sentinel · Hub-spoke · Identity path · Interview