Finding Holes in Conditional Access Policies

Microsoft Entra Conditional Access sits at the forefront of organization’s security boundaries. The ever-changing climate of conditional access continues to give administrators more and more security controls. The tradeoff of which is increased complexity when attempting to balance security and productivity. The more policies deployed in a tenant, the greater the chance for misconfigurations that create opportunities for exploitation. Whether you’re a cloud administrator, security consultant, or adversary, the goal remains the same: find the holes in conditional access.

This talk discusses lessons learned from real-life engagements and identifies multiple strategies for evaluating conditional access. Topics and tooling are explored that view conditional access from several different angles. First, understanding PowerShell and Graph API is vital when combing through policies, finding gaps in user, group, role, location, application, or device configuration. Second, simulation of logon criteria and reporting on authentication events helps to understand where policies fall short. Finally, creating a visual representation of each policy is helpful to better see policy details or build executive reports. Each of these provides an important piece of the puzzle when attempting to identify methods to bypass security controls.

Audience members should expect to leave with an arsenal of new tools and techniques to continuously monitor conditional access for risk.

Importance: Over the last several years, I have helped numerous companies improve their cloud security posture. I continue to be surprised at the increasing number of conditional access policies being layered one after the other. I see MFA policies that are not applied to all privileged roles, location limiting policies that overlap trusted IP scopes, policies using numerous different conditions yielding them nearly impossible to apply, and many more.

This topic speaks to a vast audience, as defenders should be aware of the power conditional access has in their tenant. Assessors and pentesters should be performing in-depth evaluations of conditional access to investigate opportunities for lateral movement and security bypass.

Tools and techniques discussed in this talk begin with built-in Entra features like “insights and reporting”, and using the what-if tool. I will also highlight scripts written by Sean McAvinue, idPowerToys by Merill Fernando, the Maester framework, and a few simple transparent scripts of my own. Thank you for your time and consideration. I very much look forward to my first CypherCon.