Eric Woodruff

Extracting Sensitive Information from Azure Load Testing Learn how Azure Load Testing's JMeter JMX and Locust support enables code execution, metadata queries, reverse shells, and Key Vault secret extraction vulnerabilities.

I have a new post out on the @netspi.bsky.social blog today. This one is on extracting sensitive information from the Azure Load Testing service. www.netspi.com/blog/technic...

Home - Eric on Identity This blog is about all things identity and identity adjacent. Right now, the focus is primarily on Azure AD and the Microsoft identity world, but it could have potential to expand in the future.

Quote of the day:
“MSFT has architected themselves into this corner”
#fwdcloudsec25

@ericonidentity.com

A photo taken from a train, near Heidelberg Germany, of a crop field with some brown green grass and a hazy blue sky with a tint of orange from the sunrise. There is a reflection on the window of myself somewhat from inside the train car.

Going right from @wearetroopers.bsky.social in Heidelberg to @fwdcloudsec.org in Denver ✈️ - from one excellent conference to another!

I’m looking forward to speaking Monday @ 2:00pm in track 1 on the dangers of #nOAuth, with some new and tweaked slides and talking points!

#Entra #EntraID

nOAuth revisited by @ericonidentity.com at @wearetroopers.bsky.social

New nOAuth Abuse Alert: Entra Cross-Tenant Saas Apps at Risk Think nOAuth abuse is old news? We wish. Our recent testing shows that nearly 10% of apps in the Microsoft Entra Gallery remain vulnerable.

At @wearetroopers.bsky.social I dropped new research on #nOAuth, an abuse of #EntraID that allows you to spoof users in vulnerable SaaS applications. The attack is still alive and well.

You can read all about it here:

#Entra #M365 #infosec

www.semperis.com/blog/noauth-...

A photo taken from an airplane of the. There are small white fluffy clouds scattered below and a slightly hazy blue sky with white wisps above them.

On the way to #TROOPERS25. The short flight is down… just waiting for the long one to Frankfurt.

Looking forward to talking about #nOAuth with #Entra… sadly it’s still a thing 😑

#EntraID #infosec @wearetroopers.bsky.social

Did you know you can send LAPS passwords to Entra on Server OS? Neither did @adamgrosstx.bsky.social or I until yesterday! Just need to hybrid join the server(s) and set the GPO to backup to "AAD"! Neat!

In 2019, before the AZ-104 days, I failed AZ-101 the first time around…

A picture taken from inside an airplane out the airplane window. The plane is on the ground, and the picture shows the jet bridge for the next gate with some workers outside. It’s still dark outside.

Obligatory photo from airplane en route to the #mvpsummit

Now do Yggdrasil 😏

The last two months have been a chaotic whirlwind of emotions and activity. I needed to talk about it, so I did: jakehildreth.github.io/blog/2025/03...

Yesterday morning, I woke up to an email from Microsoft with the subject "Congratulations on your Microsoft MVP award". I immediately thought it was a phish, but I dug a bit further.

It's real! 🤯 I was selected as an MVP in "PowerShell" and "Identity & Access"!

📢 To all attendees, sponsors, and speakers of MC2MC Connect!

📸 We have uploaded all the event photos to the Gallery page on the MC2MC Connect website, so you can look back and relive the day!

🔗 connect.mc2mc.be/gallery/

#MC2MC #ConnectMC2MC #MC2MCConnect

IDPro 2025 Skills, Programs, and Diversity Survey Take this survey powered by surveymonkey.com. Create your own surveys for free.

If you work in, around, near, adjacent, or so on, to #identity, including #infosec and #Entra, you should fill out the #IDPro skills survey. It takes five minutes and really helps in understanding the industry landscape.

www.surveymonkey.com/r/L9QB6T2

An interesting M365 billing scam - Eric on Identity A look at a recent spam scam email that I received, trying to understand what mechanism the attacker is using to deliver the scam email.

I received an interesting #M365 subscription email the other week, that turned out to be a scam.

I figured I'd pick it apart, and found it curious enough to share the details.

#entra #infosec #m365security #azure

ericonidentity.com/2025/02/20/a...

Not yet… 😬. Congrats to you though! I’m hoping I’ll be there regardless of speaking to catch your talk!

We’re pleased to announce the next speaker for MC2MC Connect: @ericonidentity.com 🚀

In this session, Eric will dive deep into the most common questions about app registrations, enterprise apps, and service principals. 🔍🛡️

🔗 tinyurl.com/5dxvnsn4

#MC2MC #ConnectMC2MC

Zuckerberg 'Loves' AI Slop Image From Spam Account That Posts Amputated Children Zuckerberg seems to enjoy the spam that has taken over his flagship product.

Zuckerberg "loved" an AI slop image on a spam page that also posts AI images of children with amputations, elderly people, fake images of graves, links offsite to ad-loaded pages, etc. Exciting stuff for me

www.404media.co/zuckerberg-l...

Spying on your ISVs credential choices - Eric on Identity Examining Entra ID sign-in and graph activity logs to determine what type of credentials your ISVs use in their multi-tenant applications.

If you consume multi-tenant apps in #EntraID, and they’ve been granted consent to do things in your tenant, you can spy on the auth choices your vendor makes - secrets or certs - in the logs available in your #Entra tenant.

#infosec #m365 #azure

ericonidentity.com/2025/01/13/s...

Oh I’ve submitted a few things at various places… hoping to be at Identiverse one way or another this year

With all the speaking I burnt and crashed a bit towards the end of 2024. I plan on writing about the speaking experience… but first hoping to get back into writing more as I research stuff. Hope to have both a personal blog and Semperis blog article out this week 🤞.

A screenshot of a portion of an email from MSRC for the 2024 W4 leaderboard with two valid cases totaling 75 points.

Looking forward to when I can talk about the more interesting case 👀 #MSRC #Entra

Yup 🫡

From what I gathered listening to it the other week at a partner event my takeaway was scenario #1 as well. I was going to ask the question in line with what you’re wondering; or at least I was wondering about fidelity/granularity. But I already was scolded for asking non-sales questions 😛

Great advice; received a variant of this last week that had an old password I used to use in it 😅

Want to run roadrecon, but a device compliance policy is getting in your way? You can use the Intune Company Portal client ID, which is a hardcoded and undocumented exclusion in CA for device compliance. It has user_impersonation rights on the AAD Graph 😃

Pretty sure the two green checkmarks means it’s doubly verified valid

NTLM v1 is removed from the latest version of Windows

Oh by the way

The Moynihan Train Hall Starbucks is an absolute machine of efficiency.