azure-roles-digger.sh

Mon, 16 Mar 2026 00:00:00 +0000

The problem

Azure permission auditing is a special kind of hell.

You run az role assignment list and get back… direct assignments. That’s it. No inherited roles from group nesting. No Entra ID directory roles. No PIM-eligible roles sitting there waiting to be activated. Nothing about what that service principal can actually do when you trace the full chain.

So you’re left clicking through 15 portal blades, running separate Graph queries, cross-referencing group memberships by hand, piecing it all together in a spreadsheet like it’s 2005. And after 30 minutes you’re still not sure you found everything.

UA_MFA_bypass

Mon, 16 Mar 2026 00:00:00 +0000

The technique

Orgs love enforcing MFA via Conditional Access policies. Makes the compliance people happy, box gets checked, everyone goes home. Except then someone realizes their meeting room displays can’t handle modern auth prompts. And the office printers need to talk to SharePoint. And legacy Outlook 2013 clients are still on half the floor.

So they add exclusions. Lots of exclusions:

Legacy mail clients (Outlook 2010, 2013)
Meeting room devices (Teams Rooms, Surface Hub)
IoT devices, printers, healthcare monitors
Gaming consoles (yes, a PlayStation can authenticate to Entra ID)

Here’s the thing — when you hit the ROPC (Resource Owner Password Credential) flow, you authenticate with just username + password. No browser, no redirect, no MFA prompt. And the only thing telling Azure what “device” is connecting is the User-Agent header.

Azure on ioctl

azure-roles-digger.sh

The problem

UA_MFA_bypass

The technique