AADInternals.com

Terms of Service There is no service level agreement (SLA) with any of the tools.

window.location='https://www.youtube.com/watch?

In September 2024, I tweeted about my intentions to split AADInternals module in two as AVs and MDE was blocking its installation.

Last year I gave a presentation titled Dumping NTHashes from Azure AD at TROOPERS conference.

My recent talk at the great T2 conference on DoSing Azure AD gained a lot of attention.

A couple of weeks ago a friend of mine asked would it be possible to pre-register MFA for users in Azure AD.

In my previous blog post I explained how Group Managed Service Accounts (gMSA) passwords are stored locally on the servers.

Multi-factor Authentication (MFA) and Conditional Access (CA) policies are powerful tools to protect Azure AD users’ identities.

Tenant information Due to massive automated request attacks, the original anonymous OSINT service had to be permanently closed in September 2025.

In 13 September 2022, Secureworks published a Threat Analysis: Azure Active Directory Pass-Through Authentication Flaws.

Group Managed Service Accounts (gMSA’s) can be used to run Windows services over multiple servers within the Windows domain.

In August 2022, I’ll have several presentations regarding Azure AD security, open-source tools, and bug bounties.

In my previous blog posts I’ve covered details on PRTs, BPRTs, device compliance, and Azure AD device join.

In 2018, I blogged first time about risks related to Delegated Administrative Privileges (DAP) given to Microsoft partners.

On this page you’ll find recordings and slides from my conference talks around the 🌎🌏🌍.

AADInternals toolkit is best known of its offensive or red teams tools.

Azure AD Connect Health is a feature that allows viewing the health of on-prem hybrid infrastructure components, including Azure AD Connect and AD FS servers.

I’ve talked about AD FS issues for a couple years now, and finally, after the Solorigate/Sunburst, the world is finally listening 😉 In this blog, I’ll explain the currently known TTPs to exploit AD FS certificates, and introduce a totally new technique to…

Devices (endpoints) are a crucial part of Microsoft’s Zero Trust concept.

In October 2020, someone contacted me and asked whether it would be possible to create BPRTs using AADInternals.

Administrators can use teams policies for controlling what users can do in Microsoft Teams.

The new AADInternals release v0.4.4 AADInternals Cloud Identity Summit 2020 edition is now released!

The ongoing global phishing campaings againts Microsoft 365 have used various phishing techniques.

Azure Cloud Shell is a browser-based shell for managing Azure resources using your favourite shell, Bash or PowerShell.

In my previous blog I demonstrated how to create a Persistent Refresh Token (PRT) by joining imaginary device to Azure AD.

Lately we have seen great articles by @_dirkjan, @tifkin_, @rubin_mor, and @gentilkiwi about utilising Primary Refresh Token (PRT) to get access to Azure AD and Azure AD joined computers.

Multi-factor Authentication (MFA) is nowadays a recommended method for providing extra protection for users.

This post is part 5⁄5 of Azure AD and Microsoft 365 kill chain blog series.

This post is part 4⁄5 of Azure AD and Microsoft 365 kill chain blog series.

This post is part 3⁄5 of Azure AD and Microsoft 365 kill chain blog series.

This post is part 2⁄5 of Azure AD and Microsoft 365 kill chain blog series.

imageMapResize(); Introduction According to Verizon’s Data Breach Investigations Report 2020, externals attackers are considerable more common than internal attackers.

This post is part 1⁄5 of Azure AD and Microsoft 365 kill chain blog series.

Sean Metcalf (@Pyrotek3) organised a great webcast at the end of the May 2020.

Microsoft changed the location of ADSync encryption keys in Azure AD Connect version 1.4.x.

In my earlier blog, I explained how Azure AD identity federation works under-the-hood.

Microsoft has published a PowerShell module for their partners to ease and automate operations with their customers.

OneDrive has a security option to allow syncing only from PCs joined to specific domains.

In my earlier blog post I explained how to create a backdoor to Azure AD using an identity federation vulnerability feature I discovered in 2017.

On October 25th, I’ll be talking at t2.fi infosec conference in Helsinki.

In 2017, Oliver Morton introduced a feature he found in Office 365 Active Sync, allowing enumerating the existence of the users based on http status codes.

I was honoured to hear that I was accepted to present my AADInternals toolkit at the most respected information security event in the world: Black Hat USA 2019.

Identity federation is regarded as the most secure way to authenticate users to Azure AD.

Microsoft (finally!)

On November 2018 Azure AD MFA was down over 12 hours preventing users from logging in to Office 365.

For the last couple months I’ve used most of my free time on studying and hacking Azure AD admin APIs.

By default, any user of Office 365 or Azure AD tenant can read the content of Azure AD using PowerShell and Graph API Explorer.

Microsoft Teams has been available for free since July 2018.

I’ve recently noticed that many organisations moving to Office 365 are struggling with their current on-premises non-routable UPNs.