# Attack path: identity is how they walk in Source: https://ai.techclick.in/blog_azure_identity_attack_path Markdown: https://ai.techclick.in/blog_azure_identity_attack_path.md Publisher: Techclick Infosec Pvt Ltd Stolen refresh token, standing Owner, app registration secret. Identity is the path. PIM, not standing admin. Dummy tenant. ## The ticket pay-api disk is encrypted. NSG is tight. Firewall logs are clean. A guest created a new Owner assignment at 03:11 from an unfamiliar refresh-token replay. Defender secure score did not move. Sentinel is empty because nobody connected Entra. Quick interview answer Modern Azure intrusion is usually an identity path : phished password or MFA fatigue, stolen refresh token / PRT , over-privileged Owner / User Access Administrator , or a leaked app registration client secret . Network controls never see it. Mitigations: CA + phishing-resistant MFA, token protection / continuous access evaluation where you have it, no standing admin ( PIM eligible + MFA + reason + time-box), no secrets in Git (lesson 5), break-glass monitored (lesson 4), Sentinel on SigninLogs and AuditLogs (lesson 7). Hunt the directory, not only the VNet. Hero · hallway The Firewall never received a packet. The directory did. Lab data · dummy only Tenant techclick-lab.in · MG tc-root / tc-landing / tc-workloads · subs sub-hub sub-spoke-app · hub VNet 10.40.0.0/16 · spoke 10.41.0.0/16 · Azure Firewall 10.40.0.4 · VPN GW public 203.0.113.50 · on-prem FortiGate WAN 203.0.113.10 . Not a live tenant. ## Mental model Path What they stole What they become User Password / refresh token / PRT Priya, then whatever roles she has Standing RBAC Nothing — it was already granted Owner on sub-spoke-app forever Workload identity App registration client secret The app, with Graph or ARM rights Around the Firewall - Stolen token Entra STS ARM / Graph Owner 10.40.0.4 never sees this If your only sensor is Firewall network rules, this path is silent. ## How to choose Privilege Do Do not Subscription Owner PIM eligible on a group, activate for hours Standing Owner on a Hotmail Global Admin Two people, PIM, monitored Daily mail in that role App auth Managed identity / federated credential Client secret in Git for years https://portal.azure.com Training mock · not live Azure portal Home Microsoft Entra ID Virtual networks Azure Firewall Microsoft Entra ID → Privileged Identity Management ### Azure resources · sub-spoke-app Role Owner Assignment type Eligible · group wl-owners Activation MFA + reason + 4 hours · dummy Standing Owner on personal ID None — removed App registrations with secrets 0 active · MI used by pay-api Cancel Save PIM eligible, not standing. Training mock. ## Runbook #### Side A — assignments az role assignment list on sub-hub and sub-spoke-app . Kill standing Owner/User Access Administrator on personal users. Move to groups + PIM. - #### Side B — apps + tokens Entra → App registrations → Certificates & secrets. Expire or delete unused secrets. Prefer MI (lesson 5). Review sign-ins with unusual refresh-token / unfamiliar client. - #### Side C — prove Activate Owner via PIM in the lab, do the change, let it expire. Sentinel rule on PIM activations + bg-emergency. No new standing assignment remains. az · dummy az role assignment list --subscription sub-spoke-app --include-inherited -o table # Principal Role Type # wl-owners Owner Group (make this PIM eligible) # priya@techclick-lab.in Reader User az ad app list --all --query "[].displayName" -o tsv # pay-api-old # retire its client secret az monitor activity-log list --offset 1d --query "[?contains(operationName.value, 'roleAssignments')].operationName.value" -o tsv # Microsoft.Authorization/roleAssignments/write ## Four failures ### 1 · Standing Owner The token only has to be stolen once. It keeps working. ### 2 · App secret in Git Rotate is not optional. Assume it is already being used. ### 3 · Firewall-only detection Identity path never hits 10.40.0.4. ### 4 · Guest with User Access Administrator They can mint Owner. That is the path. ## How to prove it Close only when 1) No standing Owner on a personal ID. 2) App secrets are gone or dated. 3) Entra logs are in the workspace. 4) You can narrate the path without mentioning a port. ## Traps Comfortable lie Fix We have MFA, so tokens are safe Refresh tokens / session replay still exist — CA + device + PIM Reader cannot hurt us True until they also have an app secret with Graph write PIM is licensed later Then you still remove standing Owner. Delay is not a design. ## Knowledge check Judgment items. One best answer. Reasons send you back to the matching section. Q1 A stolen refresh token typically bypasses… Entra entirely The hub Firewall packet path RBAC Key Vault purge protection Correct: b . Identity path. Q2 Standing Owner on a personal ID is bad because… Owner cannot use az One stolen session is lasting privilege Owner disables CA Owner renames GatewaySubnet Correct: b . Failure 1. Q3 PIM is used to… Make admin eligible and time-boxed instead of standing Replace NSGs Issue public IPs Disable Log Analytics Correct: a . Just-in-time admin. Q4 A leaked app registration client secret is… Harmless if NSG is tight A workload identity the attacker can replay The same as a WAF bypass Fixed by reboot of pay-api Correct: b . Path 3. Q5 Best first hunt command/blade? az role assignment list + Entra sign-in/audit Disable Azure Firewall Flush DNS on Priya Delete the spoke Correct: a . Runbook. Q6 User Access Administrator matters because… It can create further role assignments (including Owner) It is read-only It is a WAF SKU It is the break-glass name Correct: a . Failure 4. Check answers Reset Azure security class series: Shared + Entra · Landing zone · NSG vs Firewall vs WAF · Conditional Access · Key Vault + MI · Private Link · Defender + Sentinel · Hub-spoke · Identity path · Interview ## Sources - Microsoft Learn — Shared responsibility in the cloud . - Microsoft Learn — What is Conditional Access? . - Microsoft Learn — About Azure Key Vault . - Microsoft Learn — What is Microsoft Sentinel? . Related: Azure session factory · Migration series . --- Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees. Browse all lessons: https://ai.techclick.in/blogs AI index: https://ai.techclick.in/llms.txt