I recently published an article on Datadog Security Labs. This article is about how Entra ID’s restricted management and hidden membership administrative units (AUs) can be used for privileged persistence:
Hope you find it interesting!
Hidden in Plain Sight: Abusing Entra ID Administrative Units for Sticky Persistence
This post is licensed under CC BY 4.0 by the author.