3.2.2. Compromised Identities: Entra ID and Defender for Identity

💡 First Principle: An identity is compromised when someone other than its owner can authenticate as it. Containment must remove every way the attacker can keep authenticating: the password, active sessions and tokens, any MFA methods or app consents they added, and, in hybrid environments, both the cloud and on-premises copies of the account.

Microsoft Entra ID Protection detects risk in cloud sign-ins and accounts. Sign-in risk flags suspicious authentications (anonymous IP, atypical travel, token anomalies); user risk flags accounts likely compromised (leaked credentials, attacker activity). Risky users and detections appear in the Defender portal's identity pages and incidents. Response actions on a risky user include confirm user compromised (sets user risk to high, so risk-based Conditional Access policies apply), reset password, revoke sessions (invalidating refresh tokens so stolen tokens stop working), dismiss user risk for false positives, and block sign-in. After token theft such as an adversary-in-the-middle attack, revoking sessions matters more than resetting the password, because the attacker holds a token, not the password.

Microsoft Defender for Identity (MDI) watches on-premises Active Directory through sensors on domain controllers, AD FS, AD CS, and Entra Connect servers. Its alerts map to ATT&CK stages: reconnaissance (account enumeration, LDAP reconnaissance), credential access (Kerberoasting, AS-REP roasting, brute force), lateral movement (pass-the-hash, pass-the-ticket, overpass-the-hash), and domain dominance (DCSync, Golden Ticket, suspicious changes to sensitive groups). Each alert names the source device, the account, and the target, which point you to the next containment step. MDI's response actions on a user include disable user in AD, force password change, revoke session, and mark as compromised; they run through MDI's action account on the domain controllers. Honeytoken accounts (decoy accounts nobody should ever use) produce high-confidence alerts when touched.

Hybrid identities need both halves. A synced account compromised on-premises must be disabled in AD (which syncs), and its cloud sessions revoked in Entra ID because existing tokens aren't affected by an on-premises change. After containment, review what the attacker may have planted: newly registered MFA methods, inbox rules, mail forwarding, OAuth consents, and group memberships.

⚠️ Exam Trap: "An attacker stole a user's session token through an adversary-in-the-middle phishing page. What should you do first?" Revoke sessions (and confirm compromise). A password reset alone leaves the stolen token valid until it expires. Conversely, a Kerberoasting alert is an on-premises MDI signal; the response involves the service account's password in AD, not Entra ID risk policies.

Reflection Question: List the persistence mechanisms an attacker might add to a compromised Microsoft 365 account, and for each, the product or log where you would find it.