Microsoft Entra Organizational Messages Writer and Approver roles assigned to the same user or group
A user with both Entra ID organizational message writer and approver roles can create and approve messages without oversight, exposing an attack path due to compromised dual control.
Microsoft Intune Multi Admin Approval access policies not configured
Intune tenant without Multi Admin Approval access policies exposes sensitive actions to unauthorized administrators, enabling attackers to perform malicious activities with ease.
AD account configured or modified to use RC4 encryption
Active Directory accounts using RC4 encryption are vulnerable to password cracking and forged Kerberos tickets, enabling lateral movement and data breach.
Active Directory SMB signing not enforced on domain controller
Active Directory SMB signing not enforced on domain controllers exposes SMB traffic to tampering and relay-style attacks, enabling attackers to bypass authentication and access sensitive data.
Insecure ACLs on Service Connection Points in Active Directory
Insecure ACLs on Service Connection Points in Active Directory expose sensitive data and enable man-in-the-middle attacks through unauthorized attribute modifications.
Active Directory SMB signing not enforced on domain controller
Dangerous ACLs expose certificate containers
Critical: Non-default principals with elevated permissions on the NTAuthCertificates container expose certificate containers, enabling privilege escalation and CA compromise through attack paths.
Dangerous enrollment permission on authentication certificate templates
Misconfigured certificate templates expose Active Directory Certificate Services to unauthorized users obtaining high-privilege certificates due to excessive enrollment permission.
Privileged Microsoft Entra account not registered for MFA
Privileged Microsoft Entra accounts without multi-factor authentication (MFA) expose organizations to identity-based attacks via password-only authentication.
Privileged AD user synced to Microsoft Entra ID
Privileged AD users are synced to Microsoft Entra ID, exposing sensitive resources to unauthorized access.