Standing Intune admin access turned Stryker into a wipe event

At a glance

What this is: This is an analysis of how standing Intune administrator access let attackers use legitimate device-management controls to wipe Stryker’s estate at scale.

Why it matters: It matters because privileged access to endpoint management platforms can become a catastrophic control plane if it is not time-bound, reviewed, and revocable.

👉 Read Venice.io’s analysis of standing Intune admin access and the Stryker wipe event

Context

Standing admin access becomes a governance failure when a compromised credential can activate destructive control plane powers without time-bound approval. In this case, Microsoft Intune was not a passive management tool but a live enterprise action surface that could issue remote wipes across the fleet.

The identity governance issue is not malware resilience alone, but whether privileged device-management access is standing, scoped, and revocable at issuance time. When Intune administrator rights persist indefinitely, any account that can inherit them can convert a login into enterprise-wide impact.

Stryker’s starting point is a worst-case example of what happens when privileged access to a device management platform is left continuously available rather than treated as an exceptional operational privilege.

Key questions

Q: What breaks when standing Intune admin access is not in place?

A: The main failure is not convenience, it is destructive control removal. If no one holds permanent Intune admin access, a stolen credential cannot immediately issue fleet-wide wipe commands or other high-impact changes. The attacker loses the standing authority that makes management-plane abuse possible, which sharply limits blast radius.

Q: Why is standing privileged access so dangerous for device-management platforms?

A: Because device-management platforms are designed to act at scale. If the privileged role is continuously available, anyone who steals or inherits that account can use legitimate management functions to push disruptive actions across thousands of assets. The risk is not only credential theft, but the combination of standing privilege and high-impact administrative reach.

Q: What signs suggest a device-management admin role is being abused?

A: Look for sudden bulk actions, unusually rapid command sequences, administration from unfamiliar locations, or privileged activity that does not match normal maintenance patterns. In a platform like Intune, the warning is not just login success. It is the use of legitimate admin capabilities at a scale or cadence that does not fit approved work.

Q: Should organisations use JIT access or continuous monitoring for Intune admins?

A: They should use both for different purposes. JIT removes the standing entitlement so the role is not always available, while continuous monitoring helps detect abuse during the short window when access is active. One reduces exposure duration, the other constrains misuse inside that duration, which is why the controls are complementary rather than interchangeable.

Technical breakdown

How standing Intune admin access becomes a control plane compromise

Intune administrators can push configuration, deploy software, and issue remote wipe actions across managed devices. That makes the admin role equivalent to a control plane with destructive reach, not just an IT convenience layer. When the role is permanently active, compromise of the underlying account inherits all of that authority immediately. The critical weakness is not the tool itself but the access model around it. A standing role collapses the separation between authentication and authorisation because possession of one credential becomes enough to trigger high-impact action.

Practical implication: treat Intune administrator access as a privileged control plane entitlement, not a routine support permission.

Why stolen credentials were enough without malware or lateral movement

The article describes a chain that began with stolen employee credentials, likely from infostealer malware, followed by escalation into Active Directory and then Intune administration. Once the attacker reached that role, the platform’s own management function became the attack mechanism. No endpoint payload was required because the destructive action was carried out through legitimate administrative commands. This matters because many governance models still focus on malware detection and network movement, while the real risk sits in who can invoke privileged management actions from a valid session.

Practical implication: correlate privileged session use with command intent, not just endpoint compromise indicators.

Why JIT and continuous evaluation change the failure mode

Just-in-time elevation changes the problem from permanent eligibility to temporary authorisation. Instead of leaving Intune admin rights active indefinitely, access exists only for a task window and then disappears. Continuous access evaluation adds a second check by watching for unusual behaviour during that short window, such as mass wipes from a suspicious context. The combination matters because one control prevents standing privilege from existing, while the other constrains abuse if issuance has already happened. That is the governance shift this incident exposes: the attack path only works when privilege is both standing and unmonitored.

Practical implication: pair JIT privilege with live session evaluation for high-impact device-management roles.

Threat narrative

Attacker objective: The attacker’s objective was to disable devices, disrupt operations, and maximise enterprise impact through legitimate management controls.

1. Entry occurred through stolen employee credentials, likely obtained with infostealer malware and used to access Active Directory.
2. Credential escalation reached Intune administrator, creating standing access to a platform capable of issuing enterprise-wide device actions.
3. Impact followed when the attacker used Intune to trigger remote wipes across the organisation and automated the destructive commands to keep them going.

Breaches seen in the wild

• Stryker Microsoft Intune Wiper Attack: Compromised Microsoft Intune credentials enable wiper attack wiping 200,000 Stryker devices.
• Verkada camera breach 2021: Admin credentials on Verkada's exposed Jenkins support server let hackers into a support interface and customer cameras at 97 customers.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Standing Intune admin access is a governance defect, not just an access-control choice. The role carries control-plane authority that can wipe devices, interrupt operations, and override business continuity assumptions. When that authority persists indefinitely, the organisation has effectively pre-authorised destructive action for any account that can inherit the role. Practitioners should treat persistent Intune administration as an unacceptable privilege exposure window.

Zero Standing Privilege becomes the decisive control boundary for endpoint management platforms. The Stryker case shows that the issue is not whether the attacker is sophisticated, but whether privileged access exists long enough to be stolen and reused. If the role is never standing, stolen credentials do not automatically translate into destructive capability. Practitioners should reframe Intune governance around ephemeral issuance rather than persistent assignment.

Ephemeral privilege is the named concept this incident sharpens. A device-management admin role is safe only when it exists for a task, not as a permanent entitlement in the background. That concept matters because management consoles turn identity into action, so the risk is defined by access lifetime as much as by access scope. Practitioners should align privileged access policy to access duration, not just role design.

Standing admin access to a management plane creates identity blast radius. Once the attacker reached Intune administration, the platform itself became the delivery mechanism for enterprise-wide harm. That means governance has to account for the blast radius of legitimate admin tools, not only for malware execution paths. Practitioners should rank device-management entitlements alongside the highest-risk privileges in the environment.

This incident validates lifecycle governance as an operational control, not a periodic review exercise. The failure was not simply that access existed, but that it remained active without a boundary that forced re-approval or automatic removal. Governance programmes that do not continuously narrow privileged access will always remain vulnerable to credential theft. Practitioners should measure whether privileged roles are ever truly inactive when they are not being used.

From our research library:

• 91% of organisations say at least half of their privileged access is always-on, and only 1% have fully implemented just-in-time privileged access, according to a CyberArk study.
• Read next: Just-in-Time Access and Zero Standing Privilege Guide

What this signals

Ephemeral privilege, not permanent admin membership, is the control model this case forces into the foreground. Device-management platforms create an outsized identity blast radius because their legitimate actions can become destructive at enterprise scale. When those privileges are standing, the organisation has already accepted the attacker’s most useful precondition.

Governance teams should now assume that any role capable of mass device action belongs in the same policy class as the highest-risk administrative access. The practical shift is from periodic review of who has access to continuous enforcement of whether access exists at all when it is not being used.

For practitioners

• Eliminate standing Intune administrator roles Remove persistent Intune admin assignments and require task-scoped elevation so the role only exists during approved maintenance windows.
• Classify device-management admins as high-impact privilege Place Intune and similar management-plane roles under the same scrutiny as domain administration, with explicit approval and revocation rules.
• Tie elevation to continuous session evaluation Monitor active admin sessions for abnormal actions such as mass wipe commands, unusual source locations, or sudden changes in command volume.
• Audit for accounts that can inherit Intune authority Map every path from standard user credential to device-management privilege, including Active Directory escalation routes and delegated admin roles.
• Require automatic revocation after task completion Make revocation immediate and non-optional when the admin task ends, so there is no lingering window for reuse or abuse.

Key takeaways

• Standing Intune access can turn a stolen admin credential into enterprise-wide destruction without malware or zero-days.
• The Stryker case demonstrates how quickly control-plane privilege can translate into operational shutdown and large-scale data loss.
• Removing persistent privilege and forcing task-scoped elevation are the controls most directly tied to limiting this failure mode.

Key terms

• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.
• Zero Standing Privilege: A control model in which an identity does not keep persistent access unless it is actively needed. For NHIs, this means credentials and permissions are issued for a narrow task and then removed. It reduces the time window and reuse value of stolen access.
• Control-Plane Access: Control-plane access is the ability to change cloud infrastructure, configuration, or policy through management APIs. It is more sensitive than ordinary data access because it can create, alter, or delete the environment itself. In NHI incidents, control-plane access is often the point where valid credentials become material impact.
• Privilege Escalation: An attack technique where a compromised identity, often an NHI with initially limited permissions, exploits vulnerabilities or misconfigurations to gain elevated access rights, typically leading to broader compromise.

What's in the full article

Venice.io's full blog post covers the operational detail this post intentionally leaves for the source:

• The attack timeline from credential theft to Intune escalation and enterprise wipe commands
• The description of how the hidden script kept the wipe activity running
• The platform-specific explanation of Venice’s JIT role elevation mechanism
• The continuous access evaluation signals Venice says it uses during active admin sessions

👉 Venice.io’s full post covers the Intune escalation path, the wipe mechanics, and the JIT plus CAEP control model.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.