Conditional Access decides which device platforms it trusts based on the User-Agent, a value the client controls. Windows, Linux, iPhone all get blocked. So, we try something the policy never accounted for: Xbox Series X. The result is a Microsoft Graph access token, issued without ever triggering MFA.

With that token we go straight to Graph, enumerating users, groups and roles with GraphRunner, completely bypassing the portal restrictions. A custom script then scans directory objects for secrets and finds a clear-text password sitting in a group description. It belongs to a break-glass account with Global Administrator.

One policy gap and one badly stored secret, chained into a full tenant compromise.

Blocking the admin portal is not enough. Conditional Access has to cover the underlying APIs and token acquisition paths, security decisions must not rely on client-controlled signals like the User-Agent, MFA belongs on every sensitive path, and secrets must never live in directory attributes a standard user can read.

Want to learn more about Attack Reconstruction & Defense Evasion?

Join our FREE live webinar:

Close the Attack Visibility Gap: Detecting Defense Evasion and Reconstructing Attacks in Microsoft Environments

Discover how attackers create gaps in security visibility and how defenders can reconstruct what happened from fragmented evidence across Microsoft environments.

Paula Januszkiewicz and Amr Thabet will look at the challenge from both sides, from reconstructing attacks and finding the evidence attackers leave behind to understanding how modern defense evasion techniques can make malicious activity harder to detect.

Register for free:
https://luma.com/uylurofs

Want to know more?

The post CQURE Hacks #82: Microsoft Entra ID Conditional Access Bypass via User-Agent Policy Gap appeared first on CQURE Academy.