Common Entra ID Security Assessment Findings - Part 4: Weak Conditional Access Policies

The provided content discusses several critical aspects of securing user accounts in cloud environments using Azure Active Directory (AAD) Conditional Access policies. The main points can be summarized as follows:

Key Points

1. Conditional Access Policy for Security Information Registration:

   • A dedicated Conditional Access policy should protect the action "Register security information" to prevent attackers from registering new MFA methods or self-service password reset mechanisms.
   • If such a policy is missing, an attacker who compromises a user's password can register their own MFA method before the general MFA requirement kicks in. This allows them to bypass subsequent MFA requirements and gain full access.

2. Attack Scenario: Missing Protection for Security Information Registration:

   • Alice’s account has no MFA methods registered yet.
   • An attacker compromises Alice's password through a brute-force attack or phishing.
   • The attacker uses the compromised credentials with tools like EntraTokenAid to register their own MFA method, bypassing existing Conditional Access policies that require compliant devices or joined devices.

3. Conditional Access Policy Scope and Coverage:

   • Policies targeting specific resources (like Microsoft Admin Portals) may not cover all potential attack vectors.
   • The built-in resource "Microsoft

Read the full article at Compass Security Blog

---

Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.