#RomHack2021 - Dirk-jan Mollema - Breaking Azure AD joined endpoints in zero-trust environments
Security researchers examine technical aspects of #RomHack2021 - Dirk-jan Mollema - Breaking Azure AD joined endpoints in zero-trust environments.
Summary
Azure AD and Zero Trust Basics
Dirk-jan Mollema clarifies the talk targets Entra ID cloud identity, not on-prem Active Directory. Zero trust combines user and device identity signals for access decisions.
Device Join Models
Azure AD Join, registered BYOD containers, and hybrid joined devices each create device objects manageable via Intune or on-prem GPOs, with different trust boundaries.
Join Flow Internals
Device registration posts CSR, transport keys, and loosely validated metadata to Microsoft's enterprise registration service, returning a tenant-signed device certificate and local admin group changes.
Attacker Opportunities
Mollema previews abusing primary refresh tokens, unofficial device registration, and Intune-admin MFA bypass techniques against joined endpoints in zero-trust architectures.
Related talks
TROOPERS IT Security Conference·59 min
Industry experts analyze emerging threats surrounding Breaking Azure AD joined endpoints in zero-trust environments.
Videos·51 min
Elias Issa
Elias Issa examines Device Code Phishing Is Dead, Long Live New Azure AD Attacks!.
Videos·54 min
Engineers explore architecture and security mechanisms for Breaking And Fixing Azure AD Device Identity Security by Dirk-jan Mollema.