Attackers Bypass Azure AD Conditional Access Using Phantom Device Registration

A recent authorized red team operation by Howler Cell has demonstrated a critical attack path that completely bypasses Microsoft Entra ID (Azure AD) Conditional Access.

Azure Conditional Access acts as the primary gatekeeper for cloud identity security, enforcing access rules based on user location, device compliance, and calculated risk scores.

However, by starting with a single set of valid credentials, often purchased for a few hundred dollars on cybercriminal markets, researchers compromised a production tenant with over 16,000 users.

Without touching a corporate endpoint or deploying malware, they mapped a direct path to Global Administrator privileges. The vulnerability does not lie in a single component but in the misplaced trust chain between device registration and identity services.

Bypass Azure AD

The attack centers around the Device Registration Service (DRS). When Conditional Access blocks an account, it is not necessarily a dead end.

Researchers from Cyderes found that the DRS endpoint lacked protection in enforcement mode. This allowed them to authenticate through a path that Conditional Access did not block.

The DRS API validates tokens but does not verify that the caller is a real Windows machine. With a single command, attackers can register a phantom device with a signed Azure AD certificate and a private key.

No physical hardware, Trusted Platform Module (TPM), or administrative approval is needed. Adversaries frequently register new devices to compromised user accounts to successfully bypass multi-factor authentication and conditional access rules.

This technique mirrors the operations of Storm-2372, a Russian state-aligned threat actor that has been exploiting this specific gap since August 2024 to target critical infrastructure globally.

Once the phantom device is registered, attackers can generate a Primary Refresh Token (PRT). The PRT is considered one of the most valuable authentication artifacts on a Windows device, allowing silent access to cloud resources without repeated verification.

While it is normally secured by hardware, researchers successfully requested and stored a PRT in a plaintext file on a simple Linux laptop.

Because this PRT carries cryptographic device claims, it tricks the network into believing the device is legitimately authenticated. When this token is exchanged, it successfully bypasses Conditional Access policies that require a trusted device.

The next step involves bypassing Intune Mobile Device Management (MDM) compliance. Intune restrictions often exempt hybrid domain-joined devices from pre-registration.

Attackers exploited this by declaring a fake hybrid domain membership during enrollment. Intune then checked the phantom device for security features like BitLocker and Secure Boot.

Because the fake device returned empty values, Intune’s default logic marked these missing responses as “not applicable” rather than “non-compliant.” Consequently, the Linux laptop was officially marked as a fully compliant corporate device.

Data Exfiltration and Privilege Escalation

With full compliance achieved, the attackers accessed the Intune Management Extension to download enterprise applications.

A single decrypted application package revealed internal server hostnames, administrative share structures, and network architecture details. This level of intelligence usually requires weeks of lateral movement inside a network.

Furthermore, the researchers identified a massive structural risk in hybrid environments. The targeted directory contained hundreds of on-premises accounts synced to the cloud with privileged roles, including Global Administrators.

By compromising just one synced on-premises privileged account, attackers could reset the passwords of cloud Global Administrators, taking complete control of the tenant without needing any cloud-specific exploits.

The success of this operation highlights a massive configuration failure known as the “Report-Only” trap.

The targeted environment had multiple Conditional Access policies that blocked device code flows and required multi-factor authentication for device registration.

However, these vital policies were left in “Report-Only” mode. They accurately logged the malicious activity but did not block anything.

To defend against phantom device registration and identity abuse, organizations must immediately audit their Microsoft Entra ID Conditional Access policies.

Administrators should shift critical rules, specifically those blocking unauthorized device code flows (MITRE ATT&CK T1556.009) and securing device registration (T1098.005), from report-only to strict enforcement mode.

Furthermore, relying on self-reported device compliance must be replaced with strict external validation mechanisms to ensure only truly managed hardware accesses the corporate environment.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.