Microsoft disclosed a maximum-severity vulnerability in Microsoft Entra ID, formerly Azure Active Directory, tracked as CVE-2026-69836 and scored CVSS 10.0. The issue is described as an unauthenticated code execution vulnerability in the cloud identity and access management service. Microsoft says the issue has been observed as a security issue in the wild, while also stating that no customer action is required because the service-side mitigation is handled by Microsoft.
That wording matters. For a SaaS identity control plane, a no-customer-action statement usually means Microsoft patched or mitigated the hosted service globally. It does not mean defenders should do nothing. If an identity provider had an unauthenticated remote code execution path, the highest-value follow-up is tenant integrity verification: confirm there were no suspicious control-plane changes, no rogue applications, no unexpected credentials, no Conditional Access weakening, and no abnormal sign-ins around the disclosure window.
Why this is urgent
Entra ID is the trust root for Microsoft 365, Azure, SaaS single sign-on, device enrollment, administrative access, and often third-party federation. A CVSS 10.0 unauthenticated code execution flaw in that layer is a worst-case class of bug because successful exploitation could plausibly affect token issuance, directory reads or writes, application consent, service principal trust, or administrative plane behavior. The public summary does not provide exploit mechanics, indicators of compromise, affected build numbers, or a customer-side patch. Treat those details as unknown rather than invented.
The defensive priority is not to hunt for a magic string that proves CVE-2026-69836 exploitation. The priority is to hunt for post-exploitation outcomes that would matter regardless of initial vector: unauthorized privilege, persistence, policy tampering, malicious OAuth grants, service principal credential changes, and anomalous token or sign-in behavior.
Technical analysis
Affected platform: Microsoft Entra ID cloud service, formerly Azure Active Directory. The news item does not list tenant versions because Entra ID is operated as a Microsoft cloud service. There is no customer-side build, cumulative update, or on-prem agent version identified in the source.
CVE and severity: CVE-2026-69836, CVSS 10.0, described as unauthenticated code execution.
Exploitation status: The source states the flaw has been seen as a security issue in the wild. It does not provide a public proof of concept, named actor, CISA KEV status, or detailed IOCs. Do not assume KEV inclusion or a nation-state campaign unless Microsoft, CISA, or your telemetry confirms it.
Attack chain from a defender perspective: The initial access would occur at the Microsoft-hosted service boundary, before customer endpoint controls. Because Microsoft states no customer action is required, the practical risk model shifts to verification and blast-radius control. If exploitation occurred before mitigation, likely observable artifacts would appear in Entra audit and sign-in telemetry rather than in Windows process creation alone. High-signal outcomes include:
- New or modified application registrations and enterprise applications
- New service principal passwords, certificates, owners, or app role assignments
- Suspicious delegated or application consent, especially to broad Microsoft Graph scopes
- Conditional Access policy deletion, disabling, scope narrowing, or exclusion changes
- New trusted locations, named locations, authentication strengths, or weaker MFA posture
- Privileged role changes through Entra roles or Privileged Identity Management
- Legacy authentication, unusual user agents, atypical ASN or impossible travel patterns
- Token replay, refresh token abuse, or sign-ins from unexpected infrastructure after tenant changes
Detection and response guidance
The detections below are intentionally framed as post-exploitation and tenant-integrity hunts. They are not claimed to detect CVE-2026-69836 directly. Scope them by time around Microsoft advisory awareness, incident windows, change freezes, and known admin automation. Tune approved admin principals, break-glass accounts, CI service principals, and approved locations before broad deployment.
---
title: Entra ID High Risk OAuth Consent Or Broad Permission Grant
id: 6f1d5b70-3d7a-4c1e-9c2a-8f6f0a2d11aa
status: experimental
description: Detects application or delegated consent events involving broad Microsoft Graph or mail permissions that can provide persistence or data access after identity compromise.
references:
- https://attack.mitre.org/techniques/T1550/001/
author: Security Arsenal
date: 2026/08/15
tags:
- attack.persistence
- attack.collection
- attack.t1550.001
logsource:
product: azure
service: auditlogs
detection:
selection_operation:
operationName|contains:
- 'Consent to application'
- 'Add delegated permission grant'
- 'Add app role assignment'
selection_scope:
modifiedProperties.newValue|contains:
- 'Mail.Read'
- 'Mail.ReadWrite'
- 'offline_access'
- 'Directory.ReadWrite.All'
- 'RoleManagement.ReadWrite.Directory'
- 'Application.ReadWrite.All'
condition: selection_operation and selection_scope
falsepositives:
- Approved enterprise application onboarding
- Legitimate admin consent for business applications
level: high
---
title: Entra ID Service Principal Credential Or Owner Change Outside Change Control
id: 9e2c5b7f-7f1f-4f9d-9e3a-21bd7c9c4402
status: experimental
description: Detects addition of credentials, certificates, owners, or role assignments to service principals, a common persistence and privilege escalation path after identity compromise.
references:
- https://attack.mitre.org/techniques/T1098/001/
author: Security Arsenal
date: 2026/08/15
tags:
- attack.persistence
- attack.privilege_escalation
- attack.t1098.001
logsource:
product: azure
service: auditlogs
detection:
selection:
operationName|contains:
- 'Add service principal credentials'
- 'Add service principal certificate'
- 'Add owner to service principal'
- 'Add member to role'
- 'Add app role assignment to service principal'
- 'Update application certificates and secrets management properties'
falsepositives:
- CI CD secret rotation
- Approved application lifecycle changes
level: high
---
title: Entra ID Conditional Access Weakening Or Authentication Policy Tampering
id: 2a7d7ef9-5b41-4bb6-8c72-7e2b19d1056c
status: experimental
description: Detects deletion, disabling, exclusion, or weakening of Conditional Access, named locations, authentication context, or MFA-related policy that could reduce tenant resistance after compromise.
references:
- https://attack.mitre.org/techniques/T1562/007/
author: Security Arsenal
date: 2026/08/15
tags:
- attack.defense_evasion
- attack.t1562.007
logsource:
product: azure
service: auditlogs
detection:
selection:
operationName|contains:
- 'Delete conditional access policy'
- 'Update conditional access policy'
- 'Delete named location'
- 'Update named location'
- 'Update authentication strength policy'
- 'Delete authentication strength policy'
- 'Update cross tenant access settings'
- 'Update tenant restrictions'
falsepositives:
- Documented emergency change
- Planned policy migration
level: medium
// Hunt for tenant control-plane changes that commonly follow identity compromise
// Tune ApprovedActors and ApprovedServicePrincipals before production use
let Lookback = 14d;
let ApprovedActors = dynamic(['admin1@contoso.com','admin2@contoso.com','breakglass@contoso.com']);
let ApprovedServicePrincipals = dynamic(['00000000-0000-0000-0000-000000000000']);
let HighRiskOps = dynamic([
'Add service principal credentials',
'Add service principal certificate',
'Add owner to service principal',
'Consent to application',
'Add delegated permission grant',
'Add app role assignment',
'Add member to role',
'Update conditional access policy',
'Delete conditional access policy',
'Update named location',
'Delete named location',
'Update authentication strength policy',
'Delete authentication strength policy',
'Update cross tenant access settings'
]);
AuditLogs
| where TimeGenerated > ago(Lookback)
| where OperationName in (HighRiskOps)
| mv-expand InitiatedBy = todynamic(InitiatedBy)
| mv-expand Target = todynamic(TargetResources)
| extend Actor = tostring(InitiatedBy.user.userPrincipalName)
| extend ActorId = tostring(InitiatedBy.user.id)
| extend TargetDisplay = tostring(Target.displayName)
| extend TargetId = tostring(Target.id)
| extend NewValues = tostring(Target.modifiedProperties)
| where Actor !in (ApprovedActors) or isempty(Actor)
| where Result == 'success' or ResultDescription has 'success'
| project TimeGenerated, OperationName, Actor, ActorId, TargetDisplay, TargetId, NewValues, Result, CorrelationId, AADOperationId, LoggedByService
| order by TimeGenerated desc;
// Correlate tenant changes with anomalous sign-ins by the same actors
let SuspiciousActors =
AuditLogs
| where TimeGenerated > ago(Lookback)
| where OperationName in (HighRiskOps)
| extend Actor = tostring(todynamic(InitiatedBy).user.userPrincipalName)
| where isnotempty(Actor)
| summarize by Actor;
SigninLogs
| where TimeGenerated > ago(Lookback)
| where UserPrincipalName in (SuspiciousActors)
| extend App = tostring(AppDisplayName), IP = tostring(IPAddress), Loc = tostring(LocationDetails), Device = tostring(DeviceDetail)
| where ResultType != 0 or RiskLevelDuringSignIn in ('high','medium') or AuthenticationRequirement == 'singleFactorAuthentication'
| project TimeGenerated, UserPrincipalName, App, IP, Loc, ResultType, RiskLevelDuringSignIn, AuthenticationRequirement, ClientAppUsed, Device, CorrelationId
| order by TimeGenerated desc;
-- Hunt endpoints for interactive or scripted tenant administration after an Entra alert
-- Scope to approved admin workstations and automation accounts to reduce noise
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ 'Connect-MgGraph|Connect-AzureAD|Connect-AzAccount|Add-MgServicePrincipal|Update-MgConditionalAccess|New-MgApplication|Grant-MgConsent|Az ad app|az ad sp'
OR Exe =~ 'powershell.exe|pwsh.exe|az.cmd|graph'
# Verify tenant integrity after the Entra ID advisory. Read-only audit script.
# Requires: Microsoft.Graph.Authentication, Microsoft.Graph.DirectoryObjects, Microsoft.Graph.AuditLogs, Microsoft.Graph.Identity.SignIns, Microsoft.Graph.Applications
$Start = (Get-Date).AddDays(-14).ToUniversalTime()
$StartIso = $Start.ToString('yyyy-MM-ddTHH:mm:ssZ')
$Out = Join-Path $PWD ('entra-integrity-' + (Get-Date -Format yyyyMMddHHmmss))
New-Item -ItemType Directory -Path $Out | Out-Null
Connect-MgGraph -Scopes 'Directory.Read.All','AuditLog.Read.All','Policy.Read.All','Application.Read.All','IdentityRiskEvent.Read.All' -NoWelcome
$ops = @('Add service principal credentials','Add owner to service principal','Consent to application','Add delegated permission grant','Add app role assignment','Add member to role','Update conditional access policy','Delete conditional access policy','Update named location','Delete named location','Update authentication strength policy','Delete authentication strength policy')
$filter = 'activityDateTime ge ' + $StartIso
Get-MgAuditLogDirectoryAudit -Filter $filter -All | Where-Object { $ops -contains $_.ActivityDisplayName } | Export-Csv (Join-Path $Out 'high-risk-directory-audits.csv') -NoTypeInformation
Get-MgApplication -All | Select-Object Id,AppId,DisplayName,CreatedDateTime,SignInAudience | Export-Csv (Join-Path $Out 'applications.csv') -NoTypeInformation
Get-MgServicePrincipal -All | Select-Object Id,AppId,DisplayName,AccountEnabled,ServicePrincipalType,CreatedDateTime | Export-Csv (Join-Path $Out 'service-principals.csv') -NoTypeInformation
Get-MgRoleManagementDirectoryRoleAssignment -All | Select-Object Id,PrincipalId,RoleDefinitionId,DirectoryScopeId | Export-Csv (Join-Path $Out 'role-assignments.csv') -NoTypeInformation
Get-MgIdentityConditionalAccessPolicy -All | Select-Object Id,DisplayName,State,CreatedDateTime,ModifiedDateTime | Export-Csv (Join-Path $Out 'conditional-access.csv') -NoTypeInformation
Get-MgAuditLogSignIn -Filter $filter -Top 5000 | Where-Object { $_.RiskLevelDuringSignIn -in @('high','medium') -or $_.Status.ErrorCode -ne 0 } | Select-Object CreatedDateTime,UserPrincipalName,AppDisplayName,IPAddress,RiskLevelDuringSignIn,Status,ClientAppUsed,CorrelationId | Export-Csv (Join-Path $Out 'risky-or-failed-signins.csv') -NoTypeInformation
Write-Output ('Evidence written to ' + $Out)
Remediation and verification
First, confirm the authoritative status. Validate the advisory through the Microsoft Security Update Guide at msrc.microsoft.com/update-guide, Microsoft 365 admin center service health, Azure or Entra advisory channels, and the original reporting source at thehackernews.com/2026/08/microsoft-entra-id-flaw-cvss-100.html. The public item does not provide a customer patch, KB, build number, workaround, or CISA deadline. Do not fabricate one. If Microsoft says the hosted service is mitigated, your remediation is verification, monitoring, and reducing future blast radius.
Immediate actions:
- Confirm no Microsoft 365 service health, Message center, or tenant-specific notification requires customer configuration.
- Review Entra audit logs for the operations in the detections above for at least 14 days before and after disclosure, longer if your retention allows.
- Reconcile every application registration, enterprise application, service principal credential, certificate, owner, role assignment, and consent grant against change tickets.
- Disable or remove unused applications and service principals. Rotate secrets for any app that cannot be tied to an approved change.
- Enforce admin consent workflows and block user consent to high-risk scopes. Require approval for application permissions and broad delegated scopes.
- Re-check Conditional Access coverage: MFA for all users, phishing-resistant MFA for admins, block legacy auth, restrict by compliant device where feasible, and review exclusions and named locations.
- Validate break-glass accounts are excluded appropriately, monitored, stored securely, and tested.
- Use PIM just-in-time elevation for Entra roles, remove standing Global Admin where possible, and alert on role activation outside windows.
- Protect workload identities with managed identities where possible; eliminate long-lived client secrets and certificates.
- Ensure Sentinel or your SIEM is ingesting AuditLogs, SigninLogs, NonInteractiveUserSignInLogs, ServicePrincipalSignInLogs, and RiskyUsers or Identity Protection events with retention adequate for identity investigations.
If you find unauthorized changes, treat it as an identity incident: preserve logs, revoke refresh tokens, reset credentials, remove rogue grants and secrets, rotate app credentials, review downstream access to Exchange, SharePoint, Teams, Azure resources, and SaaS apps, and engage your IR retainer. If tenant integrity cannot be confidently established, escalate to Microsoft support and consider formal incident declaration rather than relying on the absence of a customer patch.
Related Resources
Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.