Persisting in an Azure AD tenant
As the core of any Azure environment, the Azure AD tenant is a great target for persistence. Once we have escalated rights within the tenant, we have several options for creating (or modifying existing) security principles that can be used to persist in the environment. In general, creating new principals in an Azure AD tenant may create more alerts than modifying existing resources, but your mileage may vary there.
As a general path for persistence, we will need to gain access to an identity, ensure that the identity has the necessary permissions, and (if needed) create policy exceptions to allow continued access to the identity.
Creating a backdoor identity
While we have covered several ways to gain access to an existing account (managed identities, clear text credentials, and more), we have not covered how to create new identities within Azure AD. Recalling back to Chapter 1, Azure Platform and Architecture Overview, we know that an identity...
