Notifications
Clear all
Topic starter
15/08/2026 6:11 pm
TL;DR: Actor Token Forgery lets attackers abuse trusted certificates and service-to-service trust chains to mint impersonation tokens in Microsoft Entra, bypassing MFA, Conditional Access, and normal log visibility, according to SlashID. The issue is not token strength alone but the assumption that delegated identity flows remain observable, revocable, and bounded at runtime.
NHIMG editorial — based on content published by SlashID: Actor Token Forgery and the trust gaps in Entra delegation chains
By the numbers:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.
Questions worth separating out
Q: What breaks when service-to-service tokens can be forged in Entra?
A: The break is not just technical acceptance.
Q: Why do trusted service principals create more risk than ordinary app registrations?
A: Trusted service principals can impersonate identities across Microsoft workloads, so compromise of their signing material has a broader blast radius than a single app session.
Q: How do security teams detect forged identity assertions in practice?
A: They compare the certificate thumbprint in the token against the registered keyCredentials set, monitor Add keyCredentials events, and correlate unusual Graph or mailbox access with recent credential changes.
Practitioner guidance
- Audit trusted delegation certificates Inventory every service principal with keyCredentials or preferredTokenSigningKeyThumbprint set, and flag certificates that are long-lived, unowned, or attached to high-privilege apps.
- Monitor certificate insertion events Alert on Add keyCredentials activity in AuditLogs, especially when a new certificate appears on Graph, Exchange, or other privileged applications without a matching entitlement change.
- Correlate app activity with identity telemetry Join mailbox, SharePoint, and Microsoft Graph access patterns with Entra audit data so service-to-service abuse can be detected even when standard sign-in logs are absent.
What's in the full article
SlashID's full post covers the operational detail this post intentionally leaves for the source:
- ROADtools command flow showing how actor tokens and impersonation tokens are generated in practice.
- Audit and detection examples for Add keyCredentials events, including high-privilege app changes.
- Integrity-check methods for comparing token thumbprints to registered certificate metadata.
- Service-to-service abuse patterns across Exchange, SharePoint, Graph, and hybrid trust paths.
👉 Read SlashID's analysis of Actor Token Forgery and Entra trust abuse →
Actor token forgery in Entra: where do current controls fail?
Explore further
15/08/2026 6:18 pm
Certificate trust without lifecycle control is the governance gap this attack exploits. The article shows that once signing material is present on a trusted service principal, the token chain can be abused without touching the user authentication layer. That means certificate issuance, key insertion, and app registration lifecycle are identity controls, not backend administration tasks. Practitioners should treat every trusted certificate as a governed credential with ownership, rotation, and offboarding.
A few things that frame the scale:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to the Ultimate Guide to NHIs.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing how slowly identity recovery can lag behind compromise.
A question worth separating out:
Q: Who is accountable when a managed identity is abused?
A: Accountability usually sits with the cloud and identity teams together. Platform owners control how the VM and metadata service are exposed, while IAM teams control RBAC scope and lifecycle review. If the identity can act beyond its workload’s purpose, the failure is governance, not just detection.
👉 Read our full editorial: Actor token forgery exposes a blind spot in Entra trust chains
