Microsoft Entra ID Accounts to Exfiltrate Microsoft 365 and Azure Data

Microsoft Entra ID is the identity platform that controls access to: 

• Microsoft 365 (Exchange, SharePoint, Teams, OneDrive) 

• Azure resources (VMs, storage, databases, etc.) 

If an attacker gains control of an Entra ID account, they can: 

• Authenticate as a legitimate user 

• Access permitted data 

• Move laterally across services 

• Exfiltrate sensitive information 

In most real-world attacks, identity compromise replaces malware as the primary entry point. 

 

Common Attack Path (High-Level) 

1. Initial Access 

Attackers obtain credentials via: 

• Phishing (most common) 

• Password spray attacks 

• Token theft (session hijacking) 

• OAuth app abuse 

 

2. Privilege Escalation 

Once inside, they try to gain higher privileges: 

• Exploiting misconfigured roles 

• Abusing global admin accounts 

• Consent phishing (malicious apps granted permissions) 

 

3. Data Discovery 

They enumerate: 

• SharePoint sites 

• OneDrive files 

• Exchange mailboxes 

• Azure storage accounts 

 

4. Data Exfiltration 

Methods include: 

• Synchronizing files to external systems 

• Using APIs (Graph API abuse) 

• Exporting mailbox contents 

• Downloading blobs from Azure Storage 

 

What Data Is Typically Targeted 

Microsoft 365 

• Emails (Exchange Online) 

• Documents (SharePoint, OneDrive) 

• Teams conversations 

• Contact lists 

Azure 

• Storage account data 

• SQL databases 

• Key Vault secrets (high risk) 

• Virtual machine disks 

 

Why Entra ID Is So Valuable to Attackers 

Because it provides: 

• Single sign-on (SSO) across services 

• Broad API access via Microsoft Graph 

• Identity trust across cloud workloads 

 One compromised identity can often unlock multiple environments. 

 

Indicators of Compromise 

Watch for: 

• Sign-ins from unusual locations 

• Impossible travel events 

• Abnormal data download volumes 

• New OAuth app registrations 

• Privilege elevation activity 

• Access tokens being reused or long-lived sessions 

 

How to Defend Against This 

1. Strong Identity Protection 

• Enforce MFA everywhere 

• Use phishing-resistant MFA (FIDO2, passkeys) 

• Enable Conditional Access policies 

 

2. Least Privilege 

• Minimize Global Admins 

• Use Privileged Identity Management (PIM) 

• Implement just-in-time (JIT) access 

 

3. Monitor and Detect 

• Enable: 

• Entra ID sign-in logs 

• Azure Activity logs 

• Microsoft 365 audit logs 

• Use Microsoft Defender for Cloud Apps / Security tools 

 

4. Control App Access 

• Restrict user consent to apps 

• Monitor OAuth permissions 

• Audit enterprise applications regularly 

 

5. Data Protection Controls 

• Use: 

• Data Loss Prevention (DLP) 

• Sensitivity labels 

• Encryption 

• Enable alerts for mass file downloads 

 

6. Token & Session Security 

• Reduce token lifetime 

• Enforce reauthentication for sensitive actions 

• Monitor refresh token usage 

 

Key Takeaway 

This isn’t about breaking into servers anymore—it’s about: 

Compromising identities to quietly access and exfiltrate data using legitimate access paths. 

In modern cloud environments: 

• Identity = perimeter 

• And Entra ID is the central control plane attackers target first 

 

If you want, I can map this to a real-world attack scenario (like Storm-0558 or token theft cases) or show how to detect it step-by-step in your environment. 

 

End-to-End Attack Scenario (Realistic Flow) 

Below is a mapped, step-by-step example of how attackers actually leverage a compromised Entra ID account to exfiltrate data. 

Stage 1: Initial Compromise 

• User receives a phishing email impersonating Microsoft 365 login 

• User enters credentials into fake login page 

• Attacker captures username + password 

• If MFA is weak, attacker performs: 

• MFA fatigue attack (push spam) 

• Token/session theft via adversary-in-the-middle proxy 

 Result: Attacker obtains valid session or credentials 

 

Stage 2: Establish Persistence 

Attacker ensures long-term access: 

• Registers a malicious OAuth application 

• Grants permissions (Mail.Read, Files.Read.All, etc.) 

• Creates new inbox rules to hide activity 

• Adds secondary authentication methods 

 Result: Access persists even if password is changed 

 

Stage 3: Internal Reconnaissance 

Attacker quietly explores the environment: 

• Queries Microsoft Graph API 

• Enumerates: 

• Users and groups 

• SharePoint sites 

• OneDrive storage 

• Azure subscriptions 

• Identifies high-value accounts and data 

 Result: Attacker builds a map of sensitive data locations 

 

Stage 4: Privilege Escalation 

If initial account is low privilege: 

• Searches for privileged role assignments 

• Exploits misconfigured permissions 

• Targets admins via phishing or token theft 

• Leverages PIM misconfigurations (standing access, weak approvals) 

 Result: Gains higher-level access (Global Admin, Application Admin, etc.) 

 

Stage 5: Data Collection 

Using legitimate access, attacker gathers data: 

• Exports Exchange mailboxes via API 

• Downloads SharePoint and OneDrive files 

• Accesses Teams chat history 

• Pulls Azure storage blobs and databases 

• Queries Key Vault for secrets 

 Result: Sensitive data staged for extraction 

 

Stage 6: Data Exfiltration 

Data is removed using stealthy techniques: 

• Bulk download via Graph API 

• Syncing files to external cloud storage 

• Exporting PST files from mailboxes 

• Copying Azure data to attacker-controlled storage 

 Result: Data leaves environment without triggering traditional alerts 

 

Stage 7: Covering Tracks 

To avoid detection: 

• Deletes audit logs (if privileged) 

• Removes or modifies alerts 

• Disables security controls 

• Blends activity with normal user behavior 

✅ Result: Delayed detection and prolonged attacker dwell time 

 

Detection Mapping (By Stage) 

Attack Stage	What to Monitor
Initial Access	Risky sign-ins, impossible travel, MFA anomalies
Persistence	New app registrations, consent grants
Recon	High volume Graph API calls, directory reads
Priv Escalation	Role assignment changes, PIM activation
Collection	Large mailbox exports, file access spikes
Exfiltration	Mass downloads, unusual data transfer volume
Cover Tracks	Audit log tampering, alert suppression

 

Defensive Alignment (Quick Mapping) 

• Stop Stage 1: Phishing-resistant MFA + Conditional Access 

• Stop Stage 2: Restrict OAuth + monitor app consent 

• Stop Stage 3: Log and alert on enumeration behavior 

• Stop Stage 4: Enforce least privilege + PIM 

• Stop Stage 5–6: DLP + download/exfil alerts 

• Stop Stage 7: Immutable logging + SIEM integration 

 

Key Insight 

Modern attacks do not “break in” — they log in, blend in, and slowly extract data using trusted identity paths. 

This is why identity security is your most critical control surface in both Microsoft 365 and Azure.