No single pane of glass: Anatomy of an Azure permission takeover

The Sysdig Threat Research Team (TRT) recently watched as an attacker started with a single leaked service-principal credential and, by the next morning, owned the tenant. This attacker took complete, dual-plane control of the tenant with Global Administrator (GA) ownership of the directory and root-level access over every resource. They planted persistence across dozens of identities and took the keys to the telemetry pipeline that was supposed to be watching them. Stopping this attack was easy. However, analyzing the attack was actually quite complex, and it came down to one question with many answers: After this attack, who and what can actually touch this tenant? In Azure, that question does not have a single answer, nor is there a single place to find one. Permission lives in at least five disjointed systems that Azure doesn’t unify. These permission systems don't share identifiers either; they have different logs and data models. An attacker can hop between them without getting caught precisely because defenders rarely look at more than one at a time. So, let’s explore how one credential walked through all five permission systems, and why a "single pane of glass" for cloud identity is still mostly aspirational. The entry point…