corpus.blog
41554 blogs · [ { "id": "01a0871e-2e5f-725b-a4fc-7d9785b97c03", "title": "Terms of Service and Privacy Statement", "url": "https://aadinternals.com/privacy/", "published_at": "2025-11-19T00:00:00+00:00" }, { "id": "01a0871e-2e5f-725b-a4fc-7d9785c7fc41", "title": "😜", "url": "https://aadinternals.com/rr/", "published_at": "2025-07-11T00:00:00+00:00" }, { "id": "01a0871e-2e5f-725b-a4fc-7d9785ce3b5b", "title": "AADInternals-Endpoints 😈", "url": "https://aadinternals.com/post/aadinternals-endpoints/", "published_at": "2024-12-10T00:00:00+00:00" }, { "id": "01a0871e-2e5f-725b-a4fc-7d978653b898", "title": "Exfiltrating NTHashes by abusing Microsoft Entra Domain Services", "url": "https://aadinternals.com/post/dcaas/", "published_at": "2024-01-13T00:00:00+00:00" }, { "id": "01a0871e-2e5f-725b-a4fc-7d978749035f", "title": "DoSing Azure AD", "url": "https://aadinternals.com/post/dosingaad/", "published_at": "2023-07-02T00:00:00+00:00" }, { "id": "01a0871e-2e5f-725b-a4fc-7d9787510558", "title": "Deploying users with pre-registered MFA", "url": "https://aadinternals.com/post/demousers/", "published_at": "2023-05-23T00:00:00+00:00" }, { "id": "01a0871e-2e5f-725b-a4fc-7d9787efddce", "title": "Elevation of Privilege from Local Admin to gMSA", "url": "https://aadinternals.com/post/local_admin_to_gmsa/", "published_at": "2023-01-23T00:00:00+00:00" }, { "id": "01a0871e-2e5f-725b-a4fc-7d97886d214d", "title": "Bypassing Azure AD home tenant MFA and CA", "url": "https://aadinternals.com/post/ests/", "published_at": "2022-11-08T00:00:00+00:00" }, { "id": "01a0871e-2e5f-725b-a4fc-7d97894c1bc7", "title": "OSINT", "url": "https://aadinternals.com/osint/", "published_at": "2022-10-11T00:00:00+00:00" }, { "id": "01a0871e-2e5f-725b-a4fc-7d978a457126", "title": "Exploiting Azure AD PTA vulnerabilities: Creating backdoor and harvesting credentials", "url": "https://aadinternals.com/post/pta/", "published_at": "2022-09-20T00:00:00+00:00" }, { "id": "01a0871e-2e5f-725b-a4fc-7d978a5a4f3c", "title": "Hunt for the gMSA secrets", "url": "https://aadinternals.com/post/gmsa/", "published_at": "2022-08-29T00:00:00+00:00" }, { "id": "01a0871e-2e5f-725b-a4fc-7d978b0d5ddd", "title": "AADInternals World Tour August 2022: USA", "url": "https://aadinternals.com/post/august_2022/", "published_at": "2022-08-01T00:00:00+00:00" }, { "id": "01a0871e-2e5f-725b-a4fc-7d978b593041", "title": "Stealing and faking Azure AD device identities", "url": "https://aadinternals.com/post/deviceidentity/", "published_at": "2022-02-15T00:00:00+00:00" }, { "id": "01a0871e-2e5f-725b-a4fc-7d978baceba8", "title": "Microsoft partners: The Good, The Bad, or The Ugly?", "url": "https://aadinternals.com/post/partners/", "published_at": "2021-12-11T00:00:00+00:00" }, { "id": "01a0871e-2e5f-725b-a4fc-7d978bfcb46e", "title": "Talks", "url": "https://aadinternals.com/talks/", "published_at": "2021-11-11T00:00:00+00:00" }, { "id": "01a0871e-2e5f-725b-a4fc-7d978c436b51", "title": "AADInternals admin and blue team tools", "url": "https://aadinternals.com/post/admintools/", "published_at": "2021-09-07T00:00:00+00:00" }, { "id": "01a0871e-2e5f-725b-a4fc-7d978c57f440", "title": "Spoofing Azure AD sign-ins logs by imitating AD FS Hybrid Health Agent", "url": "https://aadinternals.com/post/hybridhealthagent/", "published_at": "2021-07-08T00:00:00+00:00" }, { "id": "01a0871e-2e5f-725b-a4fc-7d978d5221cd", "title": "Exporting AD FS certificates revisited: Tactics, Techniques and Procedures", "url": "https://aadinternals.com/post/adfs/", "published_at": "2021-04-27T00:00:00+00:00" }, { "id": "01a0871e-2e5f-725b-a4fc-7d978ddca2a5", "title": "Deep-dive to Azure AD device join", "url": "https://aadinternals.com/post/devices/", "published_at": "2021-03-03T00:00:00+00:00" }, { "id": "01a0871e-2e5f-725b-a4fc-7d978e0e9390", "title": "BPRT unleashed: Joining multiple devices to Azure AD and Intune", "url": "https://aadinternals.com/post/bprt/", "published_at": "2021-01-31T00:00:00+00:00" }, { "id": "01a0871e-2e5f-725b-a4fc-7d978eb2bdb2", "title": "Abusing Teams client protocol to bypass Teams security policies", "url": "https://aadinternals.com/post/teams-policies/", "published_at": "2020-10-27T00:00:00+00:00" }, { "id": "01a0871e-2e5f-725b-a4fc-7d978fabe7bd", "title": "AADInternals Cloud Identity Summit 2020 edition", "url": "https://aadinternals.com/post/cloudidentitysummit2020/", "published_at": "2020-10-19T00:00:00+00:00" }, { "id": "01a0871e-2e5f-725b-a4fc-7d978fdde4b9", "title": "Introducing a new phishing technique for compromising Office 365 accounts", "url": "https://aadinternals.com/post/phishing/", "published_at": "2020-10-13T00:00:00+00:00" }, { "id": "01a0871e-2e5f-725b-a4fc-7d9790480f91", "title": "Using Azure Cloud Shell from PowerShell", "url": "https://aadinternals.com/post/cloudshell/", "published_at": "2020-09-30T00:00:00+00:00" }, { "id": "01a0871e-2e5f-725b-a4fc-7d979136a3e6", "title": "Bypassing conditional access by faking device compliance.", "url": "https://aadinternals.com/post/mdm/", "published_at": "2020-09-06T00:00:00+00:00" }, { "id": "01a0871e-2e5f-725b-a4fc-7d9791870c48", "title": "Journey to Azure AD PRT: Getting access with pass-the-token and pass-the-cert", "url": "https://aadinternals.com/post/prt/", "published_at": "2020-09-01T00:00:00+00:00" }, { "id": "01a0871e-2e5f-725b-a4fc-7d97920e2c7a", "title": "Deep-dive to Azure AD MFA: Creating a custom authenticator app", "url": "https://aadinternals.com/post/mfa/", "published_at": "2020-08-06T00:00:00+00:00" }, { "id": "01a0871e-2e5f-725b-a4fc-7d979251b24f", "title": "Unnoticed sidekick: Getting access to cloud as an on-prem admin", "url": "https://aadinternals.com/post/on-prem_admin/", "published_at": "2020-07-13T00:00:00+00:00" }, { "id": "01a0871e-2e5f-725b-a4fc-7d9792fe1a82", "title": "Keys of the kingdom: Playing God as Global Admin", "url": "https://aadinternals.com/post/admin/", "published_at": "2020-06-16T00:00:00+00:00" }, { "id": "01a0871e-2e5f-725b-a4fc-7d979335dd31", "title": "Wolf in sheep's clothing: Azure Active Directory reconnaissance as an insider", "url": "https://aadinternals.com/post/insider/", "published_at": "2020-06-15T00:00:00+00:00" }, { "id": "01a0871e-2e5f-725b-a4fc-7d9793dc5dc5", "title": "AAD Kill chain", "url": "https://aadinternals.com/aadkillchain/", "published_at": "2020-06-14T00:00:00+00:00" }, { "id": "01a0871e-2e5f-725b-a4fc-7d9794b97924", "title": "Quest for guest access: Azure Active Directory reconnaissance as a guest", "url": "https://aadinternals.com/post/quest_for_guest/", "published_at": "2020-06-14T00:00:00+00:00" }, { "id": "01a0871e-2e5f-725b-a4fc-7d9794bd7395", "title": "Just looking: Azure Active Directory reconnaissance as an outsider", "url": "https://aadinternals.com/post/just-looking/", "published_at": "2020-06-13T00:00:00+00:00" }, { "id": "01a0871e-2e5f-725b-a4fc-7d97957faa37", "title": "Getting root access to Azure VMs as a Azure AD Global Administrator", "url": "https://aadinternals.com/post/azurevms/", "published_at": "2020-06-04T00:00:00+00:00" }, { "id": "01a0871e-2e5f-725b-a4fc-7d9795e71ddb", "title": "Decrypting ADSync passwords - my journey into DPAPI", "url": "https://aadinternals.com/post/adsync/", "published_at": "2020-05-08T00:00:00+00:00" }, { "id": "01a0871e-2e5f-725b-a4fc-7d979688065c", "title": "Deep-dive to Azure AD Pass-Through Authentication", "url": "https://aadinternals.com/post/pta-deepdive/", "published_at": "2020-03-30T00:00:00+00:00" }, { "id": "01a0871e-2e5f-725b-a4fc-7d97973f3f0b", "title": "Partner Center PowerShell module sends telemetry data to Microsoft", "url": "https://aadinternals.com/post/partnercenter/", "published_at": "2020-01-19T00:00:00+00:00" }, { "id": "01a0871e-2e5f-725b-a4fc-7d9798104a6d", "title": "Bypassing OneDrive sync domain restrictions", "url": "https://aadinternals.com/post/onedrive/", "published_at": "2019-12-11T00:00:00+00:00" }, { "id": "01a0871e-2e5f-725b-a4fc-7d9798989a84", "title": "How to create a backdoor to Azure AD - part 2: Seamless SSO and Kerberos", "url": "https://aadinternals.com/post/kerberos/", "published_at": "2019-10-30T00:00:00+00:00" }, { "id": "01a0871e-2e5f-725b-a4fc-7d9799248aa6", "title": "Abusing Azure Active Directory at t2.fi 2019", "url": "https://aadinternals.com/post/t2fi2019/", "published_at": "2019-10-18T00:00:00+00:00" }, { "id": "01a0871e-2e5f-725b-a4fc-7d9799ec4dd0", "title": "Azure AD Seamless SSO allows enumerating tenant users", "url": "https://aadinternals.com/post/desktopsso/", "published_at": "2019-10-03T00:00:00+00:00" }, { "id": "01a0871e-2e5f-725b-a4fc-7d979a1676e9", "title": "AADInternals at Black Hat USA 2019 Arsenal!", "url": "https://aadinternals.com/post/bharsenal2019/", "published_at": "2019-07-10T00:00:00+00:00" }, { "id": "01a0871e-2e5f-725b-a4fc-7d979af00b6e", "title": "Deep-dive to Azure Active Directory Identity Federation", "url": "https://aadinternals.com/post/aad-deepdive/", "published_at": "2019-06-12T00:00:00+00:00" }, { "id": "01a0871e-2e5f-725b-a4fc-7d979b858d42", "title": "How to create over 256 character long passwords for cloud-only users", "url": "https://aadinternals.com/post/long-passwords/", "published_at": "2019-05-10T00:00:00+00:00" }, { "id": "01a0871e-2e5f-725b-a4fc-7d979c68e900", "title": "How to create a backdoor to Azure AD - part 1: Identity federation", "url": "https://aadinternals.com/post/aadbackdoor/", "published_at": "2018-11-21T00:00:00+00:00" }, { "id": "01a0871e-2e5f-725b-a4fc-7d979c6dc1b4", "title": "AADInternals published!", "url": "https://aadinternals.com/post/aadinternals/", "published_at": "2018-10-25T00:00:00+00:00" }, { "id": "01a0871e-2e5f-725b-a4fc-7d979d3ba780", "title": "Documentation", "url": "https://aadinternals.com/aadinternals/", "published_at": "2018-10-25T00:00:00+00:00" }, { "id": "01a0871e-2e5f-725b-a4fc-7d979d3d85fb", "title": "Block user access to Azure AD PowerShell and Graph API Explorer", "url": "https://aadinternals.com/post/limit-user-access/", "published_at": "2018-08-27T00:00:00+00:00" }, { "id": "01a0871e-2e5f-725b-a4fc-7d979da3a1c2", "title": "Technical deep dive to Microsoft Teams (free)", "url": "https://aadinternals.com/post/teams-free/", "published_at": "2018-07-25T00:00:00+00:00" }, { "id": "01a0871e-2e5f-725b-a4fc-7d979dce9a99", "title": "How to use a non-routable on-premises UPN with Office 365 and Azure AD", "url": "https://aadinternals.com/post/non-routable-upn/", "published_at": "2018-07-24T00:00:00+00:00" }, { "id": "01a0871e-2e5f-725b-a4fc-7d979e03fba1", "title": "Chasing the Unicorn: PowerShell module for 'The Secret Office 365 Forensics Tool'", "url": "https://aadinternals.com/post/exomailactivity/", "published_at": "2018-07-02T00:00:00+00:00" }, { "id": "01a0871e-2e5f-725b-a4fc-7d979e2e04c3", "title": "Admin: Take back control of Office 365 Groups, Teams, and Planner!", "url": "https://aadinternals.com/post/limit-o365-groups/", "published_at": "2018-05-31T00:00:00+00:00" }, { "id": "01a0871e-2e5f-725b-a4fc-7d979eb1fa16", "title": "How to preserve user's mailbox during the long leave", "url": "https://aadinternals.com/post/inactive-mailboxes/", "published_at": "2018-05-29T00:00:00+00:00" }, { "id": "01a0871e-2e5f-725b-a4fc-7d979f9d4c29", "title": "Office 365 email encryption", "url": "https://aadinternals.com/post/encrypt-email/", "published_at": "2018-05-16T00:00:00+00:00" }, { "id": "01a0871e-2e5f-725b-a4fc-7d979fccc21a", "title": "Is my Office 365 GDPR compliant?", "url": "https://aadinternals.com/post/o365-gdpr/", "published_at": "2018-04-25T00:00:00+00:00" }, { "id": "01a0871e-2e5f-725b-a4fc-7d97a00e87e3", "title": "Get a free custom domain for Office 365/Azure AD from www.myo365.site!", "url": "https://aadinternals.com/post/my-o365-site/", "published_at": "2018-02-20T00:00:00+00:00" }, { "id": "01a0871e-2e5f-725b-a4fc-7d97a096b783", "title": "Azure AD PowerShell module installation got easier", "url": "https://aadinternals.com/post/ps-module/", "published_at": "2018-02-09T00:00:00+00:00" }, { "id": "01a0871e-2e5f-725b-a4fc-7d97a0ded0e5", "title": "Security vulnerability in Azure AD & Office 365 identity federation", "url": "https://aadinternals.com/post/federation-vulnerability/", "published_at": "2017-11-16T00:00:00+00:00" }, { "id": "01a0871e-2e5f-725b-a4fc-7d97a1da0a0a", "title": "LIVE!360 event started today", "url": "https://aadinternals.com/post/live360_2017/", "published_at": "2017-11-12T00:00:00+00:00" }, { "id": "01a0871e-2e5f-725b-a4fc-7d97a2590539", "title": "Tools", "url": "https://aadinternals.com/tools/", "published_at": "2017-11-08T00:00:00+00:00" }, { "id": "01a0871e-2e5f-725b-a4fc-7d97a29a4318", "title": "Links", "url": "https://aadinternals.com/links/", "published_at": "2017-10-12T00:00:00+00:00" }, { "id": "01a0871e-2e5f-725b-a4fc-7d97a2b2971b", "title": "Create DNS records for Office 365 using PowerShell", "url": "https://aadinternals.com/post/dns-records/", "published_at": "2017-10-11T00:00:00+00:00" }, { "id": "01a0871e-2e5f-725b-a4fc-7d97a32e1472", "title": "Using PowerShell profile to connect to Office 365", "url": "https://aadinternals.com/post/ps-profile/", "published_at": "2017-10-10T00:00:00+00:00" }, { "id": "01a0871e-2e5f-725b-a4fc-7d97a3b7a9be", "title": "How to enable SSO for all browsers", "url": "https://aadinternals.com/post/sso-for-non-ie-browsers/", "published_at": "2017-09-28T00:00:00+00:00" }, { "id": "01a0871e-2e5f-725b-a4fc-7d97a3d6cba2", "title": "Welcome to Office 365 blog", "url": "https://aadinternals.com/post/welcome/", "published_at": "2017-09-27T00:00:00+00:00" } ] posts Claim your blog
Back to aadinternals.com
Blog · corpus.blog/blogs/aadinternals.com/posts

aadinternals.com

aadinternals.com

2025

Terms of Service and Privacy Statementoriginal ↗
19 Nov 2025
😜original ↗
11 Jul 2025

2024

AADInternals-Endpoints 😈original ↗
10 Dec 2024
Exfiltrating NTHashes by abusing Microsoft Entra Domain Servicesoriginal ↗
13 Jan 2024

2023

DoSing Azure ADoriginal ↗
2 Jul 2023
Deploying users with pre-registered MFAoriginal ↗
23 May 2023
Elevation of Privilege from Local Admin to gMSAoriginal ↗
23 Jan 2023

2022

Bypassing Azure AD home tenant MFA and CAoriginal ↗
8 Nov 2022
OSINToriginal ↗
11 Oct 2022
Exploiting Azure AD PTA vulnerabilities: Creating backdoor and harvesting credentialsoriginal ↗
20 Sept 2022
Hunt for the gMSA secretsoriginal ↗
29 Aug 2022
AADInternals World Tour August 2022: USAoriginal ↗
1 Aug 2022
Stealing and faking Azure AD device identitiesoriginal ↗
15 Feb 2022

2021

Microsoft partners: The Good, The Bad, or The Ugly?original ↗
11 Dec 2021
Talksoriginal ↗
11 Nov 2021
AADInternals admin and blue team toolsoriginal ↗
7 Sept 2021
Spoofing Azure AD sign-ins logs by imitating AD FS Hybrid Health Agentoriginal ↗
8 Jul 2021
Exporting AD FS certificates revisited: Tactics, Techniques and Proceduresoriginal ↗
27 Apr 2021
Deep-dive to Azure AD device joinoriginal ↗
3 Mar 2021
BPRT unleashed: Joining multiple devices to Azure AD and Intuneoriginal ↗
31 Jan 2021

2020

Abusing Teams client protocol to bypass Teams security policiesoriginal ↗
27 Oct 2020
AADInternals Cloud Identity Summit 2020 editionoriginal ↗
19 Oct 2020
Introducing a new phishing technique for compromising Office 365 accountsoriginal ↗
13 Oct 2020
Using Azure Cloud Shell from PowerShelloriginal ↗
30 Sept 2020
Bypassing conditional access by faking device compliance.original ↗
6 Sept 2020
Journey to Azure AD PRT: Getting access with pass-the-token and pass-the-certoriginal ↗
1 Sept 2020
Deep-dive to Azure AD MFA: Creating a custom authenticator apporiginal ↗
6 Aug 2020
Unnoticed sidekick: Getting access to cloud as an on-prem adminoriginal ↗
13 Jul 2020
Keys of the kingdom: Playing God as Global Adminoriginal ↗
16 Jun 2020
Wolf in sheep's clothing: Azure Active Directory reconnaissance as an insideroriginal ↗
15 Jun 2020
AAD Kill chainoriginal ↗
14 Jun 2020
Quest for guest access: Azure Active Directory reconnaissance as a guestoriginal ↗
14 Jun 2020
Just looking: Azure Active Directory reconnaissance as an outsideroriginal ↗
13 Jun 2020
Getting root access to Azure VMs as a Azure AD Global Administratororiginal ↗
4 Jun 2020
Decrypting ADSync passwords - my journey into DPAPIoriginal ↗
8 May 2020
Deep-dive to Azure AD Pass-Through Authenticationoriginal ↗
30 Mar 2020
Partner Center PowerShell module sends telemetry data to Microsoftoriginal ↗
19 Jan 2020

2019

Bypassing OneDrive sync domain restrictionsoriginal ↗
11 Dec 2019
How to create a backdoor to Azure AD - part 2: Seamless SSO and Kerberosoriginal ↗
30 Oct 2019
Abusing Azure Active Directory at t2.fi 2019original ↗
18 Oct 2019
Azure AD Seamless SSO allows enumerating tenant usersoriginal ↗
3 Oct 2019
AADInternals at Black Hat USA 2019 Arsenal!original ↗
10 Jul 2019
Deep-dive to Azure Active Directory Identity Federationoriginal ↗
12 Jun 2019
How to create over 256 character long passwords for cloud-only usersoriginal ↗
10 May 2019

2018

How to create a backdoor to Azure AD - part 1: Identity federationoriginal ↗
21 Nov 2018
AADInternals published!original ↗
25 Oct 2018
Documentationoriginal ↗
25 Oct 2018
Block user access to Azure AD PowerShell and Graph API Exploreroriginal ↗
27 Aug 2018
Technical deep dive to Microsoft Teams (free)original ↗
25 Jul 2018
How to use a non-routable on-premises UPN with Office 365 and Azure ADoriginal ↗
24 Jul 2018
Chasing the Unicorn: PowerShell module for 'The Secret Office 365 Forensics Tool'original ↗
2 Jul 2018
Admin: Take back control of Office 365 Groups, Teams, and Planner!original ↗
31 May 2018
How to preserve user's mailbox during the long leaveoriginal ↗
29 May 2018
Office 365 email encryptionoriginal ↗
16 May 2018
Is my Office 365 GDPR compliant?original ↗
25 Apr 2018
Get a free custom domain for Office 365/Azure AD from www.myo365.site!original ↗
20 Feb 2018
Azure AD PowerShell module installation got easieroriginal ↗
9 Feb 2018

2017

Security vulnerability in Azure AD & Office 365 identity federationoriginal ↗
16 Nov 2017
LIVE!360 event started todayoriginal ↗
12 Nov 2017
Toolsoriginal ↗
8 Nov 2017
Linksoriginal ↗
12 Oct 2017
Create DNS records for Office 365 using PowerShelloriginal ↗
11 Oct 2017
Using PowerShell profile to connect to Office 365original ↗
10 Oct 2017
How to enable SSO for all browsersoriginal ↗
28 Sept 2017
Welcome to Office 365 blogoriginal ↗
27 Sept 2017