I SPY: ESCALATING TO ENTRA ID'S GLOBAL ADMIN WITH A FIRST-PARTY APP

Summary from the TLDR InfoSec newsletter

Researchers from DataDog discovered an attack vector where an attacker could abuse an Entra ID service principal (SP) with the Cloud Application Administrator or Application Administrator roles or the `Application.ReadWrite.All` permission to obtain global admin. The attacker uses the compromised SP to hijack the Office 365 Exchange Online SP to add a new federated domain, which they can then abuse to log in as any hybrid user. The researchers reported this vulnerability to Microsoft, but it was dismissed as a configuration issue.