Azure Seamless SSO: When Cookie Theft Doesn’t Cut It

The report demonstrates a cloud privilege escalation path from an AD-synced user to Entra ID Global Administrator by combining BloodHound graph analysis, Azure Seamless SSO (via browser-based device code auth), PIM eligibility activation, and Azure Automation runbooks to add secrets to a service principal, then creating an application with Microsoft Graph roles to assign Global Administrator. It illustrates how legitimate identity flows and misconfigurations across on-prem AD and Azure resources enable lateral movement and full tenant compromise, emphasizing the importance of mapping relationships and authentication paths.