Microsoft Entra ID: Managed Device Client Sign-In to Graph Enumeration
Identification of a pattern where a non-interactive Microsoft Entra ID client sign-in, characterized by managed device context and an Edge user agent, is followed by the use of the same access token by a scripted client to perform directory enumeration via Microsoft Graph.
Triage facts
Revision 1- Applicability
- Microsoft Entra ID, Microsoft Graph
- Evidence
- Unknown
- Severity
- Medium
- Action
- Elevated
- Sources
- 8 public sources
- Freshness
- Revision 1Nov 2, 15:08 UTC
- Source quality
- B2Roughly even chance
What's new
- 1. added coverage for Microsoft Entra ID Nov 3, 15:16 via splunk-escu
This threat brief describes a detection pattern for unauthorized Microsoft Graph API usage. It correlates non-interactive Microsoft Entra ID sign-ins (asserting managed, Azure AD joined device context and an Edge user agent) with subsequent activity where the exact access token is used by a scripted client to query at least three distinct directory-enumeration paths in Microsoft Graph. This approach utilizes the unique token identifier to correlate activity, rather than relying on session identifiers.
Threat Hunt
Identify Azure AD users elevated from Guest to Member status
Data: Azure Active Directory AuditLogs (operationName="Update user")
Mitigations
Implement periodic access reviews for all guest accounts to ensure their current permissions and UserType status remain appropriate for their business function.
T1098