Notifications
Clear all
Topic starter
02/08/2026 12:01 pm
TL;DR: An attacker can pivot from a compromised user to a VM’s managed identity, then reuse that identity to run commands on other resources and reach Key Vault, bypassing network controls and standard login paths, according to Abstract Security. The blast radius assumption breaks when VM-bound identities can mint tokens for downstream access.
NHIMG editorial — based on content published by Abstract Security: Security Moving Laterally through Abuse of Managed Identities attached to VMs
By the numbers:
- NHIs outnumber human identities by 25x to 50x in modern enterprises.
- Only 5.7% of organisations have full visibility into their service accounts.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.
Questions worth separating out
Q: What breaks when an Azure VM managed identity can run commands on other resources?
A: The boundary between local workload identity and tenant-wide authorization breaks down.
Q: Why do managed identities increase lateral movement risk in Azure?
A: Managed identities increase lateral movement risk when they are granted permissions beyond the workload’s narrow purpose.
Q: How can security teams know if cloud identity governance is actually working?
A: The clearest signals are fewer unresolved access findings, shorter evidence-collection cycles, lower counts of stale keys, and reduced reliance on manual review.
Practitioner guidance
- Map every VM-attached managed identity to its real downstream reach List the Azure Resource Manager, Key Vault, and storage resources each identity can access, then flag any identity that spans unrelated resource groups or subscriptions.
- Remove shared trust from shared identities Avoid reusing a user-assigned managed identity across VMs unless the access pattern is intentionally identical and tightly bounded by policy.
- Correlate control-plane actions with metadata-derived sign-ins Join AzureActivity with managed identity sign-in logs and alert when a resource identity initiates a run-command or API call on another resource.
What's in the full report
Abstract Security's full blog post covers the operational detail this post intentionally leaves for the source:
- The exact Azure CLI and IMDS request sequence used to reproduce the lateral movement path.
- The log fields and joins used to detect a managed identity acting through another resource.
- The example Sentinel-style detection logic for correlating run-command activity with metadata endpoint use.
- The Abstract Platform rules referenced for spotting this pattern in production environments.
👉 Read Abstract Security's analysis of managed identity lateral movement on Azure VMs →
Managed identities on Azure VMs: where lateral movement starts?
Explore further
02/08/2026 1:07 pm
Managed identity lateral movement is a trust-boundary failure, not just an endpoint compromise. The attacker did not need to break the target VM’s network perimeter or log in interactively. They only needed code execution on a resource that was already trusted to mint tokens, which converted local execution into control-plane reach. For practitioners, the governance mistake is treating the VM as the primary boundary when the identity is the true boundary.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, which is why cloud identity abuse often hides inside ordinary operations.
A question worth separating out:
Q: Who is accountable when a managed identity is abused?
A: Accountability usually sits with the cloud and identity teams together. Platform owners control how the VM and metadata service are exposed, while IAM teams control RBAC scope and lifecycle review. If the identity can act beyond its workload’s purpose, the failure is governance, not just detection.
👉 Read our full editorial: Azure managed identities on VMs create lateral movement risk
