Notifications
Clear all
Topic starter
25/06/2026 1:05 am
TL;DR: Identity controls need repeatable attack-path validation, not just configuration review. EntraGoat is an open-source, deliberately vulnerable Entra ID lab built to let defenders practice privilege escalation, app ownership abuse, Graph API misuse, PIM chains, and certificate-based impersonation in a safe tenant, according to Semperis.
NHIMG editorial — based on content published by Semperis: EntraGoat, a deliberately vulnerable Entra ID environment for defender practice
By the numbers:
- Only 5.7% of organisations have full visibility into their service accounts.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures.
Questions worth separating out
Q: What breaks when Entra ID privileges are only reviewed on paper?
A: Paper reviews miss the way ownership, Graph permissions, and eligible roles combine into actual escalation paths.
Q: Why do service principals create hidden privilege risk in Entra ID?
A: Service principals can carry powerful directory permissions even when they are not treated like human admins.
Q: How do security teams know whether PIM is actually reducing risk?
A: PIM is working only if eligible access cannot be combined with ownership, consent, or role-chaining to reach privileged state faster than governance expects.
Practitioner guidance
- Map escalation paths, not just entitlements Build test cases for ownership abuse, Graph permission misuse, PIM activation chains, and privileged role inheritance so you can see which identities can actually reach admin state.
- Validate service principal governance in a live tenant Review which service principals can modify directory objects, grant consent, or impersonate higher privilege, then compare that to what your access reviews currently cover.
- Exercise certificate lifecycle controls for privileged identities Test how quickly you can revoke, rotate, and detect misuse of certificate-backed access when impersonation is the attack path, not password theft.
What's in the full article
Semperis's full blog post covers the operational detail this post intentionally leaves for the source:
- Step-by-step scenario setup for the Entra ID lab in a test tenant
- PowerShell cleanup scripts that remove lab artefacts after practice sessions
- Challenge-by-challenge hints and walkthroughs for specific escalation paths
- Interactive challenge flow and local web interface details for tracking lab progress
👉 Read Semperis's EntraGoat post on Entra ID attack-path training and abuse scenarios →
Entra ID attack labs: what IAM teams should test now?
Explore further
25/06/2026 10:16 am
Attack-path rehearsal is now a core IAM control, not a training extra. Identity teams cannot assess Entra ID resilience by reviewing policy alone when privilege escalation depends on how ownership, role activation, and API permissions combine at runtime. A lab that reproduces real attack paths turns hidden assumptions into observable failure points. The practical conclusion is that governance needs execution testing, not just design approval.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to Ultimate Guide to NHIs.
- Another 97% of NHIs carry excessive privileges, which is why identity attack-path validation matters as much as inventory.
A question worth separating out:
Q: Who should be accountable for abuse of certificate-based admin impersonation?
A: Accountability sits with the teams that own certificate issuance, identity trust, and privileged access governance. If a certificate can impersonate an admin principal, the failure is in lifecycle control and revocation oversight, not only in authentication design. Those responsibilities need explicit ownership and audit trails.
👉 Read our full editorial: Entra ID attack labs expose where identity governance breaks down
