Threat Actors Leverage Microsoft Graph & PowerShell to Enumerate Stale M365 Accounts and Licenses
What Happened — Researchers observed that adversaries are using Microsoft Graph (v2.3.9) together with PowerShell scripts to query Azure Entra (formerly Azure AD) for dormant user accounts and unused license assignments. The technique harvests metadata that can be weaponized for credential‑stuffing, privilege escalation, or selling of “golden” accounts.
Why It Matters for Compliance & Audit Readiness
- Stale accounts violate SOC 2 CC6.1 (Logical Access) and CC6.2 (User Management) requirements for least‑privilege and timely de‑provisioning.
- Continuous monitoring of Graph‑API activity provides audit‑ready evidence that only authorized identities are accessing privileged endpoints.
- Verisq’s SOC 2 Access Controls capability can automatically collect and correlate Graph‑API logs, helping you demonstrate control effectiveness to auditors.
Who Is Affected — Enterprises that rely on Microsoft 365 / Entra ID for identity, access, and licensing management (technology, finance, healthcare, education, etc.).
Recommended Actions
- Inventory all service‑principal and user accounts; disable or remove any that are inactive for >90 days.
- Enforce conditional‑access policies that restrict Graph‑API calls to approved admin accounts only.
- Deploy continuous monitoring of Microsoft Graph audit logs and map findings to SOC 2 CC6.1/CC6.2 controls.
- Document de‑provisioning workflows and retain evidence for audit review.
Technical Notes — The attack leverages Microsoft Graph API v2.3.9 and PowerShell modules (Microsoft.Graph, AzureAD). It queries Entra ID endpoints (/users, /licenseDetails) to enumerate accounts and license assignments. No public CVE is involved; the risk stems from mis‑managed identities and insufficient monitoring. Source: SANS Internet Storm Center