The Privileged Roles Nobody Talks About

This post warns that MDM platforms (ex: Microsoft Intune) are effectively Tier 0 assets: compromised admin accounts or over-permissioned Graph API app registrations can deploy SYSTEM-level scripts, push policy changes, or issue fleet-wide wipes. It documents common security failures (no account separation, no PAWs, standing privileges, missing multi-admin approval), provides prioritized mitigations (PIM, phishing-resistant MFA, Multi-Admin Approval, RBAC scoping, Conditional Access, PAWs), and supplies Sentinel KQL detection/hunting queries and recommended alerting to detect and respond to such attacks.