<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: identity-access-management
description: >-
  Identity and Access Management security including Active Directory hardening,
  Azure AD/Entra ID security, SSO misconfiguration, MFA bypass techniques, PAM
  solutions, SAML/OAuth2/OIDC attacks, conditional access policies, service account
  governance, identity governance (IGA), and zero trust identity architecture.
domain: cybersecurity
subdomain: identity-access-management
tags:
  - iam
  - active-directory
  - azure-ad
  - mfa
  - sso
  - saml
  - oauth2
  - pam
  - zero-trust
  - conditional-access
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1078", "T1098", "T1136", "T1556", "T1110"]
  nist-csf: ["PR.AC-1", "PR.AC-3", "PR.AC-4", "PR.AC-6", "PR.AC-7"]
  frameworks: ["NIST SP 800-63", "CIS Controls v8 5-6", "NIST Zero Trust SP 800-207"]
---

# Identity & Access Management Security

## When to Use

Activate when the operator asks about IAM security, MFA bypass, SSO attacks,
SAML vulnerabilities, OAuth2 misconfiguration, Active Directory hardening,
Azure AD/Entra ID security, privileged access management, conditional access
policies, or zero trust identity architecture.

Mode: `[MODE: RED]` for IAM attacks; `[MODE: BLUE]` for IAM hardening; `[MODE: ARCHITECT]` for zero trust identity design.

## Quick Reference

| Attack / Control | Technique | Context |
|-----------------|-----------|---------|
| MFA fatigue/push spam | Repeatedly trigger push notifications until user accepts | Offensive |
| SAML response forging | Modify SAML assertion (signature wrapping, XML injection) | Offensive |
| OAuth token theft | Steal authorization code via open redirect | Offensive |
| Device code phishing | Abuse OAuth device code flow for token theft | Offensive |
| Conditional access bypass | Change User-Agent, IP spoof via VPN, compliance claim | Offensive |
| Service account audit | Find accounts with no MFA, password never expires | Defensive |
| PAM implementation | CyberArk/HashiCorp Vault for privileged credential rotation | Defensive |
| Conditional access | Block legacy auth, require compliant device, risk-based MFA | Defensive |
| Identity governance | Quarterly access reviews, JIT access, entitlement management | Defensive |

## Workflow

### 1. IAM Attack Surface Assessment

```bash
# Azure AD / Entra ID enumeration
az ad user list --output table
az ad group list --output table
az ad app list --output table
az ad sp list --output table --all

# Find accounts without MFA
# Azure AD: Check per-user MFA status via MS Graph
GET https://graph.microsoft.com/v1.0/reports/credentialUserRegistrationDetails

# Service account inventory
# AD: Find accounts with password never expires
Get-ADUser -Filter {PasswordNeverExpires -eq $true} -Properties PasswordLastSet |
  Select-Object Name, SamAccountName, PasswordLastSet

# Find accounts with no MFA registered
Get-MgUser -All | ForEach-Object {
  $methods = Get-MgUserAuthenticationMethod -UserId $_.Id
  if ($methods.Count -le 1) { $_.DisplayName }
}

# Stale account detection
Get-ADUser -Filter * -Properties LastLogonDate |
  Where-Object { $_.LastLogonDate -lt (Get-Date).AddDays(-90) } |
  Select-Object Name, LastLogonDate
```

### 2. MFA Bypass Techniques

```
Attack vectors:
├── MFA Fatigue (T1621)
│   └── Repeatedly send push notifications; user eventually approves
├── SIM Swapping
│   └── Social engineer carrier to transfer victim's phone number
├── Adversary-in-the-Middle (AiTM)
│   └── Evilginx2/Modlishka proxy captures session token post-MFA
├── Token Theft
│   └── Steal session cookie/token after MFA; replay from attacker machine
├── Device Code Phishing
│   └── Abuse OAuth2 device code flow; victim enters code on legit MS page
├── Legacy Protocol Bypass
│   └── Use IMAP/POP3/SMTP (no MFA) with app passwords or basic auth
└── Recovery Code Theft
    └── Access backup codes from user's password manager or notes
```

### 3. SSO/SAML/OAuth2 Attacks

```bash
# SAML signature wrapping
# Modify assertion content while signature validates against different XML node
# Tools: SAMLRaider (Burp extension), SAML-attacks

# OAuth2 authorization code interception
# 1. Find open redirect: https://target.com/callback?redirect_uri=https://evil.com
# 2. Craft auth URL with attacker redirect_uri
# 3. Victim clicks → code sent to attacker → exchange for token

# OAuth2 scope escalation
# Request additional scopes beyond what app normally requests
# GET /authorize?client_id=X&scope=openid+profile+email+Mail.ReadWrite+Files.ReadWrite.All

# JWT confusion attacks (see api-security skill for JWT detail)

# Device code phishing (Azure)
# Attacker initiates device code flow
az login --use-device-code
# Sends "Enter code XXXXXXX at https://microsoft.com/devicelogin" to victim
# Victim authenticates → attacker gets token
```

### 4. IAM Hardening

See `references/iam-hardening.md` for full configuration guides.

**Conditional Access Policies (Azure AD):**
```json
{
  "displayName": "Require MFA for all users",
  "state": "enabled",
  "conditions": {
    "users": {"includeUsers": ["All"]},
    "applications": {"includeApplications": ["All"]},
    "clientAppTypes": ["all"]
  },
  "grantControls": {
    "operator": "OR",
    "builtInControls": ["mfa"]
  }
}
```

**Critical policies:**
- Block legacy authentication protocols (IMAP, POP3, SMTP basic)
- Require MFA for all users (no exceptions for service accounts — use managed identities)
- Require compliant/hybrid-joined device for sensitive apps
- Block sign-ins from risky locations/impossible travel
- Require password change on high-risk user detection
- Session lifetime: 1 hour for sensitive apps, 8 hours standard

### 5. Zero Trust Identity Architecture

```
Principles:
├── Never trust, always verify — every access request authenticated/authorized
├── Least privilege access — JIT/JEA for all privileged access
├── Assume breach — segment, monitor, limit blast radius
└── Verify explicitly — user identity + device health + location + risk score

Implementation:
├── Identity Provider (IdP) as control plane
├── Continuous authentication (not just at login)
├── Device trust (compliance, health attestation)
├── Micro-segmentation by identity (not just network)
├── Privileged Access Workstations (PAWs) for admin tasks
└── Identity threat detection (impossible travel, token replay)
```

## Verification

- [ ] All accounts have MFA enforced (no exceptions)
- [ ] Legacy authentication protocols blocked
- [ ] Service accounts inventoried with rotation schedule
- [ ] Conditional access policies cover all critical applications
- [ ] Stale accounts (>90 days inactive) disabled
- [ ] Privileged access managed via PAM with JIT
- [ ] SSO configurations tested for signature wrapping and token theft
- [ ] Access reviews scheduled quarterly for privileged roles
