Cloud-Architekt / AzureAD-Attack-Defense

This publication is a collection of various common attack scenarios on Microsoft Entra ID (formerly known as Azure Active Directory) and how they can be mitigated or detected.
2k stars 295 forks source link

Authorization policy - allowedToUseSSPR #42

Open BakkerJan opened 4 months ago

BakkerJan commented 4 months ago

In the current LogicApp, the allowedToUseSSPR setting from the authorization policy is interpreted as the SSPR policy for end-users.

However, this setting is managing the SSPR policy for administrators, as per documentation: https://learn.microsoft.com/en-gb/entra/identity/authentication/concept-sspr-policy?WT.mc_id=Portal-Microsoft_AAD_IAM#administrator-reset-policy-differences

This is also the result of my tests:

2024-02-18 -000220

2024-02-18 -000221