Hidden in Plain Sight: (Ab)using Entra's AUs ~ Katie Knowles

Entra Administrative Units Basics

Datadog researcher Katie Knowles explains Entra ID administrative units (AUs) as scoped containers analogous to Azure RBAC resource scopes. They let organizations assign directory roles such as User Administrator to subsets of users instead of the entire tenant, supporting regional delegation.

Restricted Management AUs

Restricted-management AUs protect sensitive accounts like executives from tenant-wide role assignments. Only principals with explicit AU-scoped roles can modify members; even Global Administrators see blocked reset and session-revocation actions until they understand the restriction.

Hidden Membership for Stealth

A poorly documented visibility flag creates hidden-membership AUs viewable only by nine privileged roles—not Security Administrator or Security Operator. The property is API-only; the Azure portal never shows it, letting attackers conceal AU membership from common security analyst roles.

Offensive and Defensive Implications

Knowles demonstrates creating hidden AUs via Graph API and how Global Admins still see members while security staff see empty lists. No vulnerability is disclosed; the talk maps legitimate enterprise features that enable sneaky persistence and urges defenders to audit AU configuration, API-created objects, and role visibility gaps.