Lateral Movement from Azure to On-Prem AD

This report explains how attackers or compromised administrators with Global Admin or Intune Administrator roles can leverage Microsoft Endpoint Manager to deploy PowerShell scripts that run as SYSTEM on hybrid Azure AD-joined devices, enabling lateral movement from Azure to on-prem AD, even across untrusted domains. It shows how to enumerate target devices, configure and assign scripts via Endpoint Manager, and highlights detection artifacts (Intune logs and registry hashes) alongside prevention guidance such as auditing privileged role assignments and identifying Intune-managed endpoints.