Entra ID Privilege Escalation via Office 365 Exchange Online SP

Arnold Chan@slaz

•updated Sep 6, 2026•3•0•5

Detects a privilege escalation technique where an attacker with application management permissions adds a credential to the 'Office 365 Exchange Online' service principal (SP). The attacker then leverages the SP's 'Domain.ReadWrite.All' permission to add or modify a federated domain, allowing them to forge tokens for any hybrid user.