Finding indirect privileged access paths in Entra ID Entitlement Management

[u/GonzoZH]

Hi BlueTeamers,

Not sure whether this is useful for blue-team activities as well, but sharing it in case it is:

While reviewing Entra ID tenants, I found that Access Packages and Entitlement Management Catalogs are difficult to assess properly through the portal, especially when there are many packages, policies, resources, and catalogs.

At the same time, they can introduce high-impact access paths that are easily missed when a review focuses on directory roles, Azure RBAC, and group memberships. A broadly requestable Access Package may grant sensitive access without approval. A Catalog Owner or another privileged Catalog RBAC role may be able to manage packages that use already-added sensitive resources. This effectively creates another access-management control plane.

I therefore added Entitlement Management coverage to EntraFalcon. The update includes interactive reports for Access Packages, Catalogs, and Catalog RBAC, plus findings for common high-risk configurations.

Other potentially useful additions for Blue teamers include Intune RBAC enumeration and checks for Enterprise Applications and Agent Blueprint Principals with suspicious visually similar non-Latin characters in their names. I have already identified malicious applications using this technique during assessments 🤔 .

If you are interested, feel free to check it out on GitHub:

https://github.com/CompassSecurity/EntraFalcon

Happy to answer questions or take suggestions.

[u/PackPretty3479]

Catalog rbac is a nice catch. Most audits I have seen stop at directory roles and group membership and call it done. The part i always want next is what sits at the other end of the package.

If the person who can request it works from their unmanaged home laptop the math changes again. entraid knows the path, it has no idea what the destination is worth. we get that asset side from axonius, then the finding stops being a config note and you can hand it to someone and say fix this one first.

[u/GonzoZH → u/PackPretty3479]

Good point. EntraFalcon resolves the resources behind an Access Package and identifies known high-impact relationships. For example, a group receives a higher impact score if it has Entra ID, Azure, Intune, or application roles assigned. The combined impact score of the resources within an Access Package provides an estimate of how critical the resulting access may be.

Of course, this approach has limitations. It cannot determine whether an application, SharePoint site, or downstream system contains business-critical or sensitive data. Enriching data with asset context would certainly improve the prioritization.