Microsoft Entra tenant with Certificate-Based Authentication enabled for all users
A Microsoft Entra tenant with Certificate-Based Authentication enabled for all users exposes users to unauthorized certificate issuance, enabling attackers to impersonate any user without a password.
Microsoft Entra application registration with dangling URI
Attackers can exploit dangling Microsoft Entra application registration URIs to obtain user sessions’ authorization tokens, enabling lateral movement or privilege escalation.
Microsoft Entra app with risky read permissions
Microsoft Entra apps with excessive read permissions expose sensitive data through OAuth 2.0 consent grants.
Microsoft Entra tenant where regular users can create Microsoft 365 groups
Regular user group creation exposes tenant-wide access, enabling attackers to collect sensitive information through group membership enumeration.
Microsoft Entra tenant with unsecure configuration of user risk policy
An unsecure user risk policy in Microsoft Entra tenant exposes users to unnecessary access risks due to inadequate password change requirements, enabling attackers to gather information and plan future malicious operations.
Entra ID tenant without policy to show geographic location context in Microsoft Authenticator notifications
Entra ID tenant without a policy to show geographic location context in Microsoft Authenticator notifications exposes users to authentication requests that may be confirmed by mistake due to lack of contextual information, enabling attackers to gain unauthorized access.
Stale Microsoft Entra service principal
A stale Microsoft Entra service principal can lead to unauthorized access and data breaches if not properly managed, exposing your organization to attack paths through compromised credentials and permissions.
AD forest is not protected against forest-wide failure by Cayosoft Guardian
A high-severity threat where an AD forest lacks a safeguard to quickly recover from catastrophic events like ransomware attacks or directory data corruption, exposing it to prolonged downtime, significant data loss, and substantial business disruption.
AD domain allowing NTLM authentication
AD domains using NTLM authentication expose sensitive information, enabling attackers to gather domain details through unauthorized access.
AD domain with misconfigured LDAP signing policy on the domain controllers
A misconfigured LDAP signing policy on Active Directory domain controllers exposes the environment to man-in-the-middle attacks, allowing attackers to intercept authentication traffic.