Attack Chain

1. The adversary compromises an application or service principal within the target Entra ID environment.
2. The attacker configures a rogue identity provider (BYOIDP) that they control.
3. The adversary creates a federated identity credential on the compromised application, linking it to their rogue identity provider.
4. The compromised application requests authentication, triggering Entra ID to validate a JWT token against the attacker's rogue identity provider.
5. Entra ID issues an access token to the compromised application based on the validation from the rogue identity provider.
6. The adversary uses the access token to access resources and data within the Entra ID environment, masquerading as the legitimate application.
7. The adversary escalates privileges or moves laterally within the environment using the compromised application's permissions.

Impact

A successful BYOIDP attack can grant an adversary unauthorized access to sensitive data and resources within an Entra ID environment. This can lead to data breaches, service disruptions, and significant reputational damage. The impact depends on the permissions and access rights of the compromised service principal. Undetected, this attack can persist, allowing continued unauthorized access.

Recommendation

• Enable collection of Microsoft Entra ID Sign-In Logs and stream them into your SIEM (per the rule's setup instructions) to gain visibility into federated credential usage.
• Deploy the provided Sigma rule Entra ID Service Principal Federated Credential Authentication by Unusual Client to detect initial federated credential usage by service principals. Tune the rule based on your environment and known CI/CD deployments.
• When the rule triggers, investigate the federated credential configuration in Entra ID, focusing on the issuer URL, creation time, and the user who added the credential as described in the rule's note section.
• Review audit logs for recent changes to application federated credentials, correlating with sign-in logs to identify unauthorized modifications.
• Baseline applications expected to use federated credentials and maintain a list of approved identity providers, as suggested in the rule's false_positives section.
• Prioritize investigation of alerts where the azure.signinlogs.caller_ip_address originates from an unexpected location or infrastructure, as described in the rule's note section.