Exploiting dynamic group memberships
The last section of this chapter covers manipulating Azure AD account details to qualify accounts for dynamic group membership. Currently, we often see dynamic groups used for device management and geographic groupings of accounts. As more organizations move their Active Directory management into Azure AD, these dynamic groups will become more popular.
As mentioned in Chapter 1, Azure Platform and Architecture Overview, dynamic group membership is based on rules that are set for parameters associated with an Azure AD account. These could be as simple as adding all users from a specific city to a group. There are multiple different ways that the rules can be configured, so we may see some pretty interesting group membership logic in real-world scenarios.
For this example scenario, we will look at the Dynamic Admins group in our azurepentesting tenant. This group has a rule to allow any user with the word admin in their email address to be...
