TL;DR: A large Azure exfiltration campaign shows how compromised Entra ID identities, partial telemetry, and costly log routing can let attackers move data out of tenants without timely detection, according to DataBahn. The real failure is not logging existence but telemetry completeness, coverage mapping, and queryable evidence when identity data is already in motion.
At a glance
What this is: DataBahn argues that Azure exfiltration becomes hard to spot when Entra ID telemetry is only partially routed, leaving attackers able to move directory data without timely detection.
Why it matters: IAM, SIEM, and cloud security teams need to treat telemetry completeness as a governance control, because logging that does not reach detection cannot support investigation or containment.
Context
Azure identity telemetry gaps create a governance problem when organisations assume logging is equivalent to detection. In this case, compromised Entra ID credentials were used to pull directory data from tenants, and the risk centred on whether the telemetry actually reached the systems that could catch the activity in time.
The core issue is not a novel exploit in Azure, but the gap between what teams believe they are collecting and what is continuously available for detection, investigation, and evidence reconstruction. That is a familiar failure pattern in large identity programmes, especially where SIEM cost pressure drives filtering, sampling, or delayed routing.
Key questions
Q: What breaks when Entra ID telemetry does not reach detection completely?
A: The control breaks because defenders lose the ability to correlate identity events into a reliable attack picture. Partial telemetry can make bulk export, token misuse, or account abuse look ordinary until the data is already gone. In practice, incomplete coverage turns identity monitoring into an audit trail with gaps, not a detection capability.
Q: Why do partial logs create such a large exfiltration risk in Azure?
A: Because identity-led exfiltration often depends on the combination of sign-in, token, and export evidence rather than any single alert. If those events are filtered, delayed, or split across stores, the attacker only needs to outrun the organisation's ability to assemble the timeline. That is a visibility failure, not a platform failure.
Q: What do security teams get wrong about identity telemetry?
A: They often use telemetry to report outcomes instead of to explain failure. Authentication events, failure counts, and usage trends only become valuable when they answer a concrete question about trust, recovery, or workflow breakage. Without that interrogation, telemetry becomes a compliance artefact rather than a driver of change.
Q: What should organisations do when tenant identity data is exposed through export activity?
A: They should immediately confirm which export events occurred, which identities were used, and whether downstream telemetry still contains the evidence needed for scoping. The priority is to rebuild the timeline from surviving identity records, then close the coverage gap that allowed the export to remain invisible.
Technical breakdown
Why partial identity telemetry creates blind spots in Azure
Azure and Entra ID environments generate high-volume identity events, including sign-ins, token issuance, export activity, and group changes. Once teams start sampling or filtering to control SIEM cost, they often lose the ability to see the exact technique they most need to detect. The issue is not whether logs exist somewhere, but whether the relevant events are continuously available at the point where detections depend on them. In practical terms, a coverage map that ages after onboarding is not a control. It is a snapshot that can drift out of sync with the environment and leave an attack path effectively invisible.
Practical implication: map telemetry to the attack techniques you can currently detect, not to the logs you think you have.
Why completeness matters more than simple log presence
A logging pipeline can appear healthy while silently dropping fields, truncating batches, or lagging under load. That creates a dangerous mismatch between the checkbox answer of 'we log that' and the operational reality of 'we log all of it, continuously.' For identity telemetry, completeness is the difference between reconstructing a tenant-wide export pattern and seeing only fragments. If field loss, delay, or broken routing is not validated in-stream, teams may discover the gap only after an incident review, when the evidence is already incomplete.
Practical implication: validate identity telemetry completeness in motion, before the data is transformed or handed off to downstream tools.
How single-query investigation depends on joined identity evidence
Once identity events are split across a SIEM, a data lake, and cold storage, investigation becomes a stitching exercise instead of a detection exercise. Analysts need one query path that can reach sign-in logs, export events, and session data without rehydration tickets or manual correlation across different access models. That is especially important when directory export activity is the first visible sign of exfiltration. Queryability is not just an analyst convenience. It is part of the evidence chain that determines whether an identity incident can be understood while it is still unfolding.
Practical implication: design for cross-store identity investigation before you need it during an incident.
Threat narrative
Attacker objective: The objective was to harvest and sell tenant identity and directory data, including organisational structure details that can support follow-on fraud, phishing, and targeted intrusion.
- Entry began with already-compromised Azure and Entra ID credentials rather than a zero-day exploit in the platform.
- Credentialed access enabled bulk directory and export activity against tenant identity data, including employee and reporting-line information.
- The data moved out of the environment while telemetry coverage, completeness, and queryability were insufficient to surface the pattern in real time.
Breaches seen in the wild
- Microsoft Storm-0558 key breach 2023: China-based Storm-0558 used a stolen, never-retired Microsoft signing key to forge tokens and read email at 22 organisations in 2023.
- Sumo Logic breach 2023: A compromised credential opened a Sumo Logic AWS account; customers were told to rotate API keys and stored credentials. No data impact was found.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Telemetry completeness is now an identity governance control, not a logging preference. If Entra ID events do not reach detection with full fidelity, the organisation does not have operational visibility no matter how many collectors are configured. This is especially true when identity data is already moving inside the tenant and the window for response is measured in minutes. Practitioners should treat coverage and completeness as governance outcomes, not infrastructure settings.
Azure identity telemetry gaps expose a coverage debt problem. The hidden risk is not only missing logs, but the accumulated gap between the techniques the environment can actually detect and the techniques security teams assume it can detect. That gap widens as cost controls, routing choices, and schema drift change what downstream tools receive. The practitioner conclusion is simple: if coverage is not continuously measured, it will decay silently.
Directory export visibility is the named concept this campaign exposes. Standard directory data becomes a high-value exfiltration target when employee IDs, reporting lines, and manager relationships can be pulled from identity systems without immediate challenge. That combination turns identity telemetry into a data-loss control surface, not just an IAM audit trail. Practitioners should govern export monitoring as part of identity and data security together.
SIEM centralisation alone does not solve identity evidence loss. Moving every event into one platform can create cost pressure that encourages sampling, filtering, or delayed ingestion, which weakens the very detections the SIEM is expected to support. The better model is selective but continuously verified telemetry that preserves the specific events required for identity attack detection. Practitioners should measure what reaches detection, not just what is collected.
What this signals
Directory export visibility is becoming a governance test for identity programmes. If a tenant can generate identity data that reaches a SIEM only in fragments, the organisation has not governed the evidence chain, only the collection process. Practitioners should assume attackers will look for the cheapest path between valid access and data removal, then design telemetry to keep that path observable.
The practical shift is from 'do we log Entra ID' to 'can we prove the right identity events are still reaching detection today'. That distinction matters because cost-driven sampling and routing decisions often erode security coverage long before anyone notices operational impact. Teams should treat telemetry drift as a measurable control failure, not a tooling nuisance.
For practitioners
- Define detection coverage for Entra ID techniques Map the specific identity techniques you expect to detect, then verify which log sources actually reach those detections right now. Treat the result as a live control inventory rather than a one-time onboarding exercise.
- Validate telemetry completeness in-stream Check for dropped fields, truncation, and delivery lag before identity events are transformed or forwarded to downstream tools. A pipeline that looks healthy but loses data under load is not dependable for exfiltration detection.
- Make identity export events queryable in one path Ensure sign-in logs, bulk export activity, and session evidence can be searched together without manual rehydration or separate access requests. The goal is a single investigative path for identity-led exfiltration.
- Prioritise identity data loss scenarios in tabletop exercises Exercise the response path for compromised Entra ID credentials moving directory data out of a tenant, including how quickly teams can confirm scope, source, and blast radius from existing evidence.
Key takeaways
- Compromised Entra ID identities can turn Azure directory exports into a high-blind-spot exfiltration path when telemetry is only partially visible.
- The problem is not the existence of logs, but whether identity events still reach detection with enough fidelity to support correlation and investigation.
- Security teams should verify coverage, completeness, and queryability continuously, because those controls determine whether exfiltration is detected in time.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | Compromised identity material and exposed directory data are the starting point of the exfiltration pattern. |
| NHI-04 — Insecure Authentication | The campaign depends on compromised Entra ID identities being usable for tenant access. | |
| Recommendation — Scan for exposed identity material and revoke any credentials that can still access directory exports. Strengthen authentication controls for tenant access and alert on anomalous sign-in behaviour. | ||
| NIST CSF 2.0 | DE.CM-01 — Monitoring for Unauthorised Personnel, Connections, Devices and Software | The article centres on whether identity telemetry is continuously monitored and reaching detection. |
| Recommendation — Continuously verify identity telemetry coverage so unauthorised use is visible to detection workflows. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | The piece highlights the operational value of reviewing identity logs that can actually be correlated. |
| Recommendation — Correlate audit records for identity exports and sign-ins so suspicious activity is investigated promptly. | ||
| MITRE ATT&CK | TA0006; TA0010 — Credential Access; Exfiltration | The campaign uses compromised credentials to enable data theft from Azure tenants. |
| Recommendation — Map compromised-account activity to credential access and exfiltration techniques to prioritise detections. | ||
Key terms
- Telemetry Completeness Validation: Telemetry completeness validation is the continuous check that expected security data arrives whole, without dropped fields, truncation, or missing batches. It goes beyond confirming that a source is connected. The control proves that the data used for detection is still intact enough to support reliable security decisions.
- Coverage mapping: Coverage mapping links specific log sources and evidence streams to the attack techniques they are expected to detect. In practice, it shows where identity telemetry can and cannot support control objectives, and it must be updated as environments, pipelines, and detection logic change.
- Directory export visibility: Directory export visibility is the ability to observe and query bulk retrieval of identity data from a tenant, including the surrounding sign-in and session evidence. It matters because exported directory records can reveal organisational structure, reporting lines, and other data useful for follow-on attacks.
- Queryable evidence: Queryable evidence is security data that can be searched, joined, and reconstructed quickly enough to support active investigation. For identity incidents, it is the difference between building a timeline in minutes and stitching together fragmented records across multiple stores after the attacker has already left.
Deepen your knowledge
NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. It is designed for practitioners who need to connect identity governance decisions to operational security outcomes.
Published by the NHIMG editorial team on August 22, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org