Excited to be putting the finishing screenshots in my #bsidesatl presentation about some new security controls that #AzureEntraID has made available around App Consent and Workload Identity protection. #entraid #Microsoft365 #cloudsecurity @bsidesatl
https://pretalx.com/bsidesatl-2025/talk/review/DMYAZJ83ZMUH8XWWPTTSBTKUYGDUHBJL
Abuse of Service Principals in EntraID has been a longstanding favorite of APT groups. In recent years, that knowledge has trickled down to eCrime actors and is leveraged for ransomware and extortion. Microsoft has introduced two (and a half) new security controls to address this in 2025. Each has its pros and cons, but as with any security control an understanding of the risk it mitigates is crucial to balance the tradeoffs against potential business disruption. In this talk, we'll go over three scenarios in which Service Principals are abused and which controls would be relevant to address this risk. We'll also explore how to perform your own testing to evaluate whether the controls you configure are functioning as expected.
"CMMC Who? The Basics of New DoD Cybersecurity Compliance"
from Chris Silvers
at #bsidesatl
@bsidesatl
Xavier Ashe 
Hamishthepiper
DFIR Notes
mcdwayne
