Identity Persistence and Privilege Abuse
| Attack type | Persistence, privilege escalation |
| Threat actors | Midnight Blizzard, Storm-2755, Storm-2372, Storm-3119 and others, once they have a foothold |
| Coverage since | October 20, 2026 |
| Platforms | Microsoft Entra ID, Azure |
Getting in is step one. Staying in is the goal. Once an attacker controls an account, the next move is to make that access survive a password reset — and to make it bigger. In Entra ID, a handful of changes do both, and every one of them looks like routine administration.
The threat
- A rogue federation trust. Setting a domain to federated, or changing its federation settings, points sign-in for that domain at an identity provider the attacker controls. From then on they can sign in as any user in the domain.
- A federated identity credential on an app. Tokens from an outside issuer then sign in as the app with no secret at all — and rotating the app's secrets does not remove it.
- Elevated access. A Global Administrator can grant themselves User Access Administrator over every Azure subscription in the tenant with a single switch.
- Privileged roles. A user, group or app quietly added to a privileged Entra ID role, or to Owner, User Access Administrator or RBAC Administrator in Azure — directly, through Privileged Identity Management, or as an eligible assignment waiting to be activated.
These are the techniques that the campaigns on these pages — and others such as Midnight Blizzard — use once they have a foothold.
How Fluency catches it
Fluency watches the Entra ID audit log for each of these changes and alerts the moment one happens, with who made it and from where. Because Fluency's risk scoring groups behaviors by the user or entity they belong to, the change is seen alongside everything else happening to that account — a suspicious sign-in, a new MFA method, a mailbox rule — so the analyst sees the takeover and the persistence as one story.
Detections included
| Detection | What it catches |
|---|---|
EntraID_Federation_Changed | A domain set to federated, or its federation settings changed. High. |
EntraID_Elevated_Access | A Global Administrator elevating to User Access Administrator over all Azure subscriptions. High. |
EntraID_FIC_Changed | A federated identity credential added to or removed from an app. Medium. |
EntraID_Privileged_Role_Assigned | A privileged Entra ID or Azure role assigned — directly, through PIM, or as eligible. Medium. |
MITRE ATT&CK
| Tactic | Technique |
|---|---|
| Defense Evasion, Privilege Escalation | T1484.002 Domain or Tenant Policy Modification: Trust Modification |
| Persistence | T1098.001 Additional Cloud Credentials |
| Persistence, Privilege Escalation | T1098.003 Additional Cloud Roles |
Get this coverage
The detections are on every Fluency instance and need the Entra ID audit logs, collected through Azure Event Hubs or Microsoft Graph. Planned administration will trigger them too — that is the point: every one of these changes deserves a second look.
Not a customer yet? Start a free trial or book a demo.
Related
- Storm-3119: app-based tenant takeover — persistence through an app and a secret of its own.
- Entra ID Detection Update — the full release, with triage guidance for each alert.