Azure / Entra ID attacks

When it applies

Target on Azure and you have some access — SSRF into a VM/App Service with a Managed Identity, a leaked service-principal secret/cert, or a foothold. Goal: steal tokens, abuse Entra roles, reach resources.

Why it works

Azure resources authenticate via Managed Identities and service principals; the IMDS hands out OAuth tokens for them. Entra (Azure AD) roles and app permissions are widely over-assigned, and several (adding credentials to a service principal, role assignment, Owner on a subscription) escalate to control.