The cloud isn’t just someone else’s computer—it’s someone else’s blast radius. In this electrifying session, I dive into real-world offensive research conducted on Microsoft Azure, dissecting the overlooked misconfigurations, insecure defaults, and identity traps that attackers are quietly exploiting at scale. From abusing Azure service principals to weaponizing Managed Identities and stealthy persistence through OIDC federation abuse, this talk unpacks how attackers can laterally move, escalate privileges, and maintain near-invisible persistence within a cloud-native environment. Expect live demos, PoCs, and tales from the trenches—of pentests that went from 0 to GlobalAdmin and cloud engagements where a single overlooked permission became a cloud-wide compromise.
Conditional Access Policies (CAP) are often seen as the gatekeepers of identity security in Microsoft Entra (Azure AD) environments but what if those gates aren't as secure as they seem? This session takes a purely offensive approach to understanding and bypassing CAP. We'll break down how these policies work, uncover common misconfigurations, and demonstrate how features like Intune, legacy authentication, token replay, and trusted device spoofing can be exploited to sidestep enforced controls. If you're a red teamer or offensive security enthusiast looking to expand your arsenal in cloud environments, this talk will arm you with practical techniques and real-world scenarios to abuse Conditional Access Policies (CAP).