Advanced Active Directory to Entra ID Lateral Movement Techniques

Advanced Active Directory to Entra ID Lateral Movement Techniques

Speaker: Dirk-Jan Mollema, Founder, Outsider Security

Conference: Black Hat USA 2025 — August 6-7, 2025, Mandalay Bay, Las Vegas

YouTube: https://www.youtube.com/watch?v=rzfAutv6sB8

Reading time: 10 min

Type: Briefing

TL;DR

Dirk-Jan Mollema of Outsider Security demonstrated that Exchange Hybrid deployments create a hidden, high-privilege attack path from on-premises Active Directory to full Microsoft 365 tenant compromise. By extracting exportable certificates from an on-premises Exchange server, an attacker can impersonate any user in Exchange Online and SharePoint without bypassing MFA or generating audit logs — and a second technique using the deprecated Access Control Service (ACS) token mechanism previously granted full Entra global admin access until a hotfix shipped the day of the talk.

Introduction

Hybrid Microsoft environments — where on-premises Active Directory connects to Entra ID (formerly Azure AD) — represent one of the largest attack surfaces in enterprise security. The implicit trust relationship means that compromising the on-prem domain is often just the first step toward owning the cloud tenant entirely.

Dirk-Jan Mollema, founder of research-and-consultancy firm Outsider Security, has spent years mapping the technical bridges between AD and Entra. This talk at Black Hat USA 2025 assembled years of cumulative research, covered three major attack families (sync account abuse, policy manipulation, and Exchange Hybrid exploitation), and included two live demos demonstrating real-world tenant compromise. Several of the techniques described resulted in Microsoft patches shipping in the days immediately preceding the presentation.

Existing Hybrid Attack Paths: The Known Baselines

▶ Watch: Hybrid Attack Overview (00:00)

Mollema opened with a fast recap of the pre-existing AD-to-Entra attack landscape:

• ADFS token forging: If an organization uses Active Directory Federation Services, the on-prem ADFS server holds a token-signing certificate. Stealing it allows an attacker to forge SAML tokens and authenticate as any hybrid user in Entra — including bypassing MFA claims, because ADFS is trusted to assert those.
• Seamless Single Sign-On (SSO) key extraction: Seamless SSO uses symmetric Kerberos keys stored in AD. Extracting those keys (via ADConnectDump or its successors) enables forged Kerberos tickets that authenticate to Entra.
• Password hash sync override: With Entra ID Connect sync credentials, an attacker can override the password hash for any hybrid user.

A subtle but important point: these attacks are not siloed per domain. Hybrid users from any synced on-prem domain are treated equivalently within the Entra tenant — compromising one domain's sync credentials can affect users synced from a different domain. Cloud-only accounts were historically protected from these attacks, but "soft matching" and "hard matching" mechanisms have allowed attackers to convert cloud-only accounts to hybrid accounts and then impersonate them.

Microsoft partially mitigated the soft-matching vector; blocking both soft and hard matching is now recommended for any hybrid deployment.

Policy Manipulation via the Sync Account

▶ Watch: Policy Attack Path (10:00)

A less-known capability of the Entra ID Connect sync account was its ability to modify Entra authentication policies directly via the Graph API. Mollema had previously documented that the sync account could:

1. Modify the on-premises authentication flow policy — reconfiguring Seamless SSO keys to add attacker-controlled Kerberos keys, enabling forged Kerberos tickets for any hybrid user.
2. Modify the default authentication methods policy — adding a fake external MFA provider, effectively letting the attacker satisfy MFA requirements for any account.
3. Enable and configure Seamless SSO — even on tenants that didn't previously use it.

These capabilities existed since at least 2019. Microsoft patched the conditional access policy angle in December 2023, but the deeper policy modifications persisted longer. In late 2024, Microsoft removed the Graph API permissions from the Entra ID Connect sync account entirely — Mollema described this as "one of the best changes they made in years." The attack paths via the sync account are now closed, though the techniques remain valid for any attacker who has already achieved global admin by other means.

"They removed all the permissions from the Entra ID Connect sync account to modify objects via the Graph API. That means we can no longer do this from on-prem." — Dirk-Jan Mollema ▶ 18:00

Exchange Hybrid: Unexpected Global Admin

▶ Watch: Exchange Hybrid Attack (20:00)

The most novel section of the talk concerned Exchange Hybrid environments. When Exchange Hybrid is configured for OAuth authentication, the setup wizard adds a certificate credential to the Exchange Online service principal in Entra. This certificate is installed on the on-premises Exchange server — and it is marked as exportable by default.

The extraction process was disarmingly simple:

"I just RDP'd to the server, I went to certificates, I did right-click, export, and they even marked the key as exportable, so I could just say, 'Yes, export the private key,' and then I had my own certificate. So basically, then I was Exchange." — Dirk-Jan Mollema ▶ 20:00

With those credentials, an attacker can authenticate to Microsoft services as Exchange Online itself. The Exchange Online service principal carries permissions to read all tenant data, modify federation configuration (including ADFS trust settings), and write to the on-premises authentication policy.

Service-to-Service Tokens and the ACS Impersonation Primitive

▶ Watch: ACS Token Mechanics (24:01)

At the heart of this attack is a legacy Microsoft-internal mechanism called Service-to-Service (S2S) tokens, issued via the Access Control Service (ACS) — an older cousin of Entra. When Exchange Online wants to access data on behalf of a user, it obtains an "actor token" from ACS, then wraps it in a partially-unsigned bearer token that includes the target user's identity.

The crucial flaw: the user identity portion of this composite token is not cryptographically signed. An attacker holding Exchange's certificate can:

1. Request an actor token from ACS (the only step requiring cloud connectivity).
2. Construct an impersonation token for any user in the tenant simply by substituting their identity in the unsigned portion.
3. Access that user's Exchange mailbox, SharePoint site, or OneDrive — with no conditional access checks and no audit logs.

"These are impersonation tokens. We can just put whoever we want in the unsigned part of the token, and then we can access the data in Exchange as that specific user." — Dirk-Jan Mollema ▶ 24:01

Tokens are valid for 24 hours and cannot be revoked. Mollema confirmed this works for Exchange Online, SharePoint Online, and OneDrive — affecting any mailbox or document repository in the tenant.

A second step extended this to full Entra global admin: by requesting an ACS actor token scoped to graph.windows.net and supplying a global admin's Net ID in the unsigned token, Mollema demonstrated adding a new global admin to the tenant in a live demo at ▶ 30:01. This also re-enabled the ability to modify conditional access policies via the legacy API — bypassing the protections Microsoft had introduced in 2023.

The graph.windows.net path was patched with a hotfix that shipped the day of the talk.

Detection Opportunities and Defensive Hardening

▶ Watch: Detection and Mitigations (32:01)

Detection: When Exchange impersonation tokens are used to make changes in Entra, audit log entries appear with a split identity — the user principal name of the impersonated account combined with the display name "Exchange Online." Mollema wrote and validated a KQL detection query that filters for this pattern while excluding legitimate Exchange PowerShell group modifications.

Adding Seamless SSO keys via the policy API generates no audit log events at all, making that path essentially undetectable without third-party tooling.

Mitigations:

• If you have Exchange Hybrid: Migrate to the new split service principal model announced by Microsoft in April 2025. Migration is required by October 2025 regardless. This separates the Exchange Online service principal from the on-prem Exchange service principal, eliminating the shared certificate attack surface.
• Check the Exchange Online service principal in Entra for keyCredentials entries. If Exchange Hybrid is not in use, remove any existing keys. Tools like Roadrecon can enumerate these — they are not visible in the standard Entra portal UI.
• Block soft matching and hard matching in Entra ID Connect settings to prevent cloud-only accounts from being converted to hybrid accounts.
• Rotate Seamless SSO keys and audit the on-premises authentication flow policy for unexpected entries.

Notable Quotes

"For the defenders out there wondering, 'Can I see this in the logs?' The answer is no. There's literally nothing generated when you do this. There's no event whatsoever." — Dirk-Jan Mollema ▶ 16:00

"Exchange Hybrid on-prem is basically global admin in the tenant." — Dirk-Jan Mollema ▶ 20:00

"This protocol is like extremely bad. I've seen a lot of bad protocols, but this one definitely wins." — Dirk-Jan Mollema ▶ 24:01

"I think this is kind of bad because if one of these tokens leaks, it's basically like 24 hours unlimited access to all the data in an entire tenant." — Dirk-Jan Mollema ▶ 26:01

Key Takeaways

• Exchange Hybrid is a high-privilege on-ramp to Entra. The exportable certificate installed by the hybrid wizard gives an attacker Exchange Online's full permission set, including cross-tenant data access via unsigned impersonation tokens.
• The graph.windows.net ACS path is now patched, but Exchange Online and SharePoint Online impersonation remain possible for any attacker who can extract the Exchange certificate. Migrate to the split service principal model by October 2025.
• Seamless SSO key additions leave no audit trail. Defenders must proactively audit the on-premises authentication flow policy and keyCredentials on the Exchange service principal, not just rely on alert queues.
• Multi-domain hybrid environments are fully interconnected. Compromising one domain's sync credentials or ADFS server provides attack paths against users in all hybrid domains.
• Block account matching in Entra ID Connect to eliminate the cloud-only-to-hybrid conversion attack path. This setting is rarely enabled by default and is not well-understood by most administrators.

Slides

Slides were not published as a separate PDF at the time of this article. The speaker indicated they would be posted online. Check Outsider Security for updates.