All You Need Is Guest
summary
Claim: EntraID guest accounts let outsiders enumerate tenants, bypass DLP and extract credentials stored by Power Apps, yielding full SQL and blob dumps. Demonstrations use TeamPhisher for Teams phishing, a refresh-token trick called family-of-client-IDs to mint tokens, and a red team tool PowerPwn that calls the internal API hub to run arbitrary SQL and return sensitive rows. Microsoft blocks creating new violating connections but existing connections from years of citizen development remain exploitable.
AI-written summary · about
chapters (13)
- 0:00Guest access in EntraID
- 1:05Why guest access exists
- 2:32Provisioning guest accounts
- 8:57Promise versus reality of guest access
- 10:45Teams phishing risks with guests
- 14:22Guest enumeration vulnerabilities
- 15:46Power Apps credential sharing risks
- 20:01Rise of citizen development
- 30:35Bypassing DLP in Power Platform
- 36:40Credential sharing flaw implications
- 39:10Introducing PowerPwn
- 42:01Defense against guest risks
- 46:20Q&A
related talks
38mAll You Need is Guest
26mTechnical Tracks
54mCredential Sharing As A Service: The Dark Side Of No Code
51mAdvanced Attack Vectors in Azure Environments
38mAbusing Azure Active Directory: From MFA Bypass to Listing Global Administrators
45mFrom Subscription to Backdoor Intruder
31mLog In Through the Front Door: Automating Defense Against...
48mHacking Exposed: Next-Generation Tactics, Techniques, and Procedures