Azure AD: Federated identity credential addition to service principal

Attackers can leverage the Entra ID (formerly Azure AD) workload identity federation feature to gain persistent access to service principals. By adding a new federated identity credential that points to an attacker-controlled OIDC issuer, a threat actor can authenticate as the service principal without requiring client secrets. This technique evades standard secrets monitoring and persists across credential rotations.

Impact

Successful exploitation grants an attacker a persistent, secretless authentication path to the target service principal, potentially allowing for lateral movement, privilege escalation, or access to cloud resources protected by the service principal identity.

Recommendation

• Baseline existing federated identity credentials across all service principals to identify legitimate OIDC configurations.
• Implement monitoring for the addition of new federated identity credentials, specifically focusing on unknown or unapproved OIDC issuers.
• Audit existing service principals for overly permissive subject claims in federated credentials.
• Use the hunt lead provided in the action plan to investigate current environment activity.