Stryker’s Intune breach shows why standing admin trust fails

At a glance

What this is: This is a breach analysis of the Stryker Intune incident, where attackers abused an existing administrator account and Intune’s built-in wipe capability to trigger large-scale device destruction.

Why it matters: It matters because IAM and PAM programmes that still rely on standing admin trust can convert a single credential compromise into broad operational damage across endpoint and cloud administration.

Context

Standing administrative access is a governance problem, not just an endpoint problem. When an admin account remains trusted all the time, whoever holds it can create new privilege, bypass approval, and execute destructive actions without a fresh authorisation step.

In the Stryker case, attackers compromised an existing administrator account, created a new Global Administrator account, and used Microsoft Intune’s wipe command. That sequence shows how static trust collapses when privileged access is always on.

For IAM, PAM, and NHI governance teams, the issue is the assumption that persistent administrative authority can be made safe through review alone. This case is a typical failure mode for static admin models in modern cloud-managed environments.

Key questions

Q: What breaks when standing Intune admin access is not in place?

A: The main failure is not convenience, it is destructive control removal. If no one holds permanent Intune admin access, a stolen credential cannot immediately issue fleet-wide wipe commands or other high-impact changes. The attacker loses the standing authority that makes management-plane abuse possible, which sharply limits blast radius.

Q: Why do standing admin accounts create such large blast radius in endpoint management?

A: They preserve authority long after the original trust decision was made. Once an attacker controls the account, they can act as a legitimate administrator, expand privilege, and trigger destructive actions without needing to defeat the platform’s logic. The result is broad impact from a single credential compromise.

Q: What signs indicate privileged administration is not being governed at runtime?

A: The warning signs are persistent admin roles, destructive actions that only require a single approval, and no separation between routine administration and irreversible commands. If the same account can both create privilege and use it immediately, the programme is relying on trust rather than control.

Q: How should teams respond when a privileged account is suspected of misuse?

A: Contain the account first by removing access, reviewing recent authentication trails and checking for other identities that share the same privileges or trust relationships. Privileged accounts can amplify one compromise into broad access, so containment has to focus on the blast radius, not just the single login event. Offboarding and revalidation should follow immediately.

Technical breakdown

How standing administrative trust enables destructive actions

Standing administrative trust means a credential carries ongoing authority until someone manually revokes it. In a cloud-managed console such as Intune, that creates a wide execution envelope: the account can create other admins, modify policy, and invoke privileged functions without re-establishing intent. The risk is not code exploitation but abuse of legitimate control paths. Once an attacker holds the credential, the platform cannot distinguish rightful administration from hostile use if no runtime verification sits in front of the action.

Practical implication: move high-risk administrative functions behind runtime authorisation rather than relying on persistent role membership.

Why built-in device wipe commands are a governance hazard

A built-in wipe command is not inherently unsafe, but it becomes dangerous when the authority to invoke it is always present. This is an entitlement problem: the command is legitimate, yet the identity boundary around it is too weak. In this case, the attacker did not need malware or a zero-day. They only needed enough privilege to reach the action and enough standing trust for the platform to accept it as valid administration.

Practical implication: treat destructive management actions as privileged transactions, not ordinary help desk operations.

Why multi-admin approval changes the attack path

Multi-admin approval breaks the direct line between account compromise and destructive execution. Instead of a single credential being sufficient to create a new admin and wipe devices, a second human must verify the request at the point of execution. That shifts control from post-event detection to preventative gating. In practical terms, approval is most valuable when the action itself is irreversible, high-impact, or difficult to roll back after completion.

Practical implication: require secondary approval for device wipes, RBAC changes, and other irreversible administrative actions.

Threat narrative

Attacker objective: The attacker’s objective was to weaponise trusted administrative access to inflict large-scale device destruction and operational disruption.

1. Entry occurred when attackers compromised an existing administrator account rather than exploiting Intune software directly.
2. Escalation followed when the attacker used that access to create a new Global Administrator account and expand authority.
3. Impact came from executing Microsoft Intune’s built-in wipe command, which erased nearly 80,000 devices and disrupted operations.

Breaches seen in the wild

• Stryker Microsoft Intune Wiper Attack: Compromised Microsoft Intune credentials enable wiper attack wiping 200,000 Stryker devices.
• CircleCI breach 2023: Malware stole a CircleCI engineer's SSO session; attackers exfiltrated customers' CI/CD secrets and keys, forcing a platform-wide rotation.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Standing admin trust is the broken assumption here. The architecture assumed a privileged account could remain safe until reviewed, but the attacker turned that constant authority into a destructive path. This is not a malware problem or an Intune code problem. The implication is that runtime privilege, not static entitlement, is the real boundary that now matters.

Protected administration by design is becoming the baseline for endpoint and cloud control. CISA and Microsoft’s guidance points in the right direction because sensitive actions such as wipes, RBAC changes, and account creation need execution-time verification. That framing is more useful than trust in a vault or a group policy because those controls do not interrupt misuse at the moment of action. Practitioners should treat privileged action gating as the control plane, not an add-on.

Zero Standing Privilege changes the meaning of compromise. If an admin account has no permanent access, compromise alone is not enough to trigger destructive actions. The attacker must first request access, and that request can be blocked, scoped, or approved in real time. That makes ZSP a structural control for administrative resilience, not just a privilege-reduction tactic.

The same governance flaw applies across human, NHI, and agentic workflows. A credential that stays live after trust has changed is a liability whether it is held by a person, a service identity, or an AI-driven workflow. The article’s most important lesson is that standing privilege is a cross-domain failure pattern, and practitioner programmes should govern all high-impact identities as execution-time risks.

Runtime approval is the named concept this incident sharpens. The breach shows that the decisive control is not who owns the admin account, but whether the environment can stop irreversible actions before they execute. Identity governance now has to focus on the action boundary, because that is where destructive authority becomes real.

What this signals

Runtime approval is becoming the dividing line between manageable and catastrophic admin compromise. Security teams should assume that persistent privilege will eventually be abused and design for execution-time control instead of after-the-fact review.

Standing privilege is a cross-domain failure pattern. The same governance gap affects human admins, service accounts, and AI-driven workflows whenever high-impact actions can be executed without a fresh trust check.

For practitioners

• Enforce zero standing privilege for endpoint admins Remove permanent access from accounts that can create administrators, modify RBAC, or invoke device-wipe commands. Grant elevation only for the verified task and revoke it immediately after use.
• Gate destructive Intune actions behind multi-admin approval Require a second approver for wipe operations, role changes, and other irreversible management commands so a single compromised credential cannot execute them alone.
• Separate routine administration from destructive control paths Use distinct access paths for day-to-day help desk work and for actions that can erase devices or reconfigure privilege, with tighter policy and logging on the latter.
• Review privileged account inventory for standing authority Identify every account with always-on administrative rights across endpoint, cloud, and identity tooling, then prioritise the ones that can trigger large-scale operational impact.

Key takeaways

• The Stryker incident shows that a single compromised admin account can become a high-impact destructive path when standing trust remains in place.
• Nearly 80,000 devices were wiped, which is the kind of scale that exposes the operational cost of always-on administrative authority.
• Execution-time approval and zero standing privilege are the controls that would have limited or blocked the attack path.

Key terms

• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.
• Multi-admin approval: Multi-admin approval is a governance control that requires more than one administrator to authorise a high-impact action. It reduces the chance that a single stolen credential can execute destructive changes such as device wipe, deletion, or policy removal without challenge.
• Zero Standing Privilege: A control model in which an identity does not keep persistent access unless it is actively needed. For NHIs, this means credentials and permissions are issued for a narrow task and then removed. It reduces the time window and reuse value of stolen access.
• Privileged Action: A privileged action is a sensitive operation that can change data, configuration, access, or control inside an environment. In modern PAM, the action matters more than the account label because the same identity may be harmless in one context and high risk in another.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.