Authentication Methods Manipulation as Cloud Persistence

When an adversary compromises an enterprise cloud identity, they anticipate that the initial access vector (stolen password, hijacked session cookie, or phished token) will eventually expire or be terminated by security operations. To secure persistent, long-term re-entry, the threat actor establishes a Secondary Factor Backdoor by registering an authentication method under their own control directly within the victim’s Microsoft Entra ID Authentication Methods profile.

Once a rogue MFA method is enrolled, the attacker decouples their persistence from the victim’s physical device. Even if the victim resets their password, the adversary can satisfy MFA prompts, maintain access, or weaponize Self-Service Password Reset (SSPR) to unilaterally seize control of the account. Furthermore, if an attacker elevates to privileged roles, they can abuse Temporary Access Passes (TAPs) to bypass MFA entirely.

This guide provides an exhaustive architectural and forensic dissection of authentication method manipulation in Entra ID, analyzes audit telemetry, and delivers production-grade KQL detection queries and PowerShell remediation scripts.

---

1. The “Backdoor Second Factor” Attack Lifecycle

The lifecycle of an authentication method backdoor unfolds across distinct operational phases:

sequenceDiagram
    autonumber
    participant Attacker as Adversary
    participant Victim as Target Account
    participant SecurityInfo as Entra ID Security Info (aka.ms/mysecurityinfo)
    participant SSPR as Entra SSPR Engine

    Attacker->>Victim: Compromises Account (Password Spray / AiTM)
    Attacker->>SecurityInfo: Authenticates to Security Info Registration Portal
    Note over SecurityInfo: Adds Attacker Phone Number or Microsoft Authenticator instance
    SecurityInfo-->>Attacker: Emits Entra Audit Log: "User registered security info"
    Note over Attacker: PERSISTENCE ANCHORED!

    alt User Resets Password
        Victim->>Victim: Changes Password (IR Incident Response)
        Attacker->>SSPR: Initiates "Forgot My Password" at login.microsoftonline.com
        SSPR-->>Attacker: Prompts for MFA Verification
        Attacker->>SSPR: Satisfies MFA using Backdoored Phone/Authenticator
        SSPR-->>Attacker: Allows setting new password without administrator assistance!
    else Attacker Re-Authenticates
        Attacker->>Victim: Authenticates with known password
        Victim-->>Attacker: MFA Prompt sent to ATTACKER'S phone/app (Victim receives no prompt!)
    end

1.1 Types of Manipulated Authentication Methods:

• Phone Authentication (PhoneAuthenticationMethod): Adding an attacker-controlled telephone number to receive SMS verification codes or automated voice calls.
• Microsoft Authenticator (MicrosoftAuthenticatorAuthenticationMethod): Registering an attacker-controlled smartphone instance of the Microsoft Authenticator app.
• Software OATH TOTP (SoftwareOathAuthenticationMethod): Registering a standard 6-digit TOTP secret into tools like Google Authenticator or custom Python scripts.
• FIDO2 Security Key (Fido2AuthenticationMethod): Registering an attacker-controlled hardware token (e.g., YubiKey) to satisfy phishing-resistant authentication requirements.
• Temporary Access Pass (TAP) (TemporaryAccessPassAuthenticationMethod): Minting a short-lived, high-privilege passcode that bypasses both password and standard MFA prompts.

---

2. Temporary Access Pass (TAP) Weaponization

A Temporary Access Pass (TAP) is a time-limited passcode configured by an administrator to allow users to onboard new devices or recover accounts without their permanent credentials.

graph TD
    COMP_ADMIN[Compromised Privileged Role<br/>User Admin / Privileged Auth Admin] --> GEN_TAP[Generate Temporary Access Pass<br/>POST /users/{id}/authentication/temporaryAccessPassMethods]

    GEN_TAP --> TAP_PROPS[TAP Properties Configured:<br/>- Lifetime: 10 minutes to 8 hours<br/>- IsUsableOnce: False / True<br/>- Strong Auth: True (Satisfies MFA!)]

    TAP_PROPS --> ATT_LOGIN[Attacker Logs In at login.microsoftonline.com<br/>Selects 'Use Temporary Access Pass']

    ATT_LOGIN --> BYPASS[Instant Cloud Access Granted<br/>No Password Needed / No MFA Push to Victim Phone]

Why TAP Abuse is Catastrophic:

1. Satisfies MFA Automatically: A TAP inherently fulfills Multi-Factor Authentication requirements under Conditional Access.
2. Victim Blindness: Unlike Authenticator push requests (which send notifications to the employee’s phone), logging in via a TAP sends zero notifications to the victim.
3. FIDO2 Enrolment: An attacker can sign in using a TAP and immediately register a permanent FIDO2 key, embedding unshakeable persistence.

---

3. Telemetry & Audit Signatures in Microsoft Entra ID

All modifications to authentication methods generate granular events in the Entra ID AuditLogs table under the UserManagement category:

Operation Name	Initiator Context	Threat Actor Objective
User registered security info	Self-Service (InitiatedBy.user)	Attacker enrolled a secondary MFA method (phone, app, TOTP) using a compromised session.
User deleted security info	Self-Service (InitiatedBy.user)	Attacker deleted the victim’s legitimate phone/authenticator to lock out the user.
User changed default authentication method	Self-Service (InitiatedBy.user)	Attacker set their newly enrolled method as default to prevent prompts reaching the victim.
Admin registered security info	Administrative (InitiatedBy.user)	Compromised admin account added security info to another user’s profile.
Generate temporary access pass	Administrative (InitiatedBy.user)	An administrator or compromised role minted a TAP for a target identity.

3.1 Analyzing the JSON Audit Payload

When inspected in Sentinel or Log Analytics, the modifiedProperties array discloses the exact method details:

{
  "activityDateTime": "2026-03-24T14:20:15Z",
  "activityDisplayName": "User registered security info",
  "category": "UserManagement",
  "result": "success",
  "initiatedBy": {
    "user": {
      "userPrincipalName": "victim@target.com",
      "ipAddress": "198.51.100.44"
    }
  },
  "targetResources": [
    {
      "userPrincipalName": "victim@target.com",
      "type": "User",
      "modifiedProperties": [
        {
          "displayName": "Method Type",
          "newValue": "\"Mobile Phone\""
        },
        {
          "displayName": "Phone Number",
          "newValue": "\"+33 7 ** ** 42\""
        },
        {
          "displayName": "Device Name",
          "newValue": "\"iPhone (Attacker Device)\""
        }
      ]
    }
  ]
}

---

4. Production KQL Hunting Queries

4.1 Detecting Rogue MFA Method Registrations

Identify users registering new authentication methods, highlighting the method type, phone number, and IP address:

AuditLogs
| where TimeGenerated >= ago(14d)
| where Category == "UserManagement"
| where OperationName in ("User registered security info", "Admin registered security info")
| extend InitiatedByUser = tostring(InitiatedBy.user.userPrincipalName),
         InitiatedByIP = tostring(InitiatedBy.user.ipAddress)
| extend TargetUser = tostring(TargetResources[0].userPrincipalName)
| extend ModifiedProps = TargetResources[0].modifiedProperties
| mv-expand ModifiedProps
| summarize
    RegisteredDetails = make_bag(pack(tostring(ModifiedProps.displayName), tostring(ModifiedProps.newValue)))
    by TimeGenerated, OperationName, InitiatedByUser, TargetUser, InitiatedByIP
| project TimeGenerated, OperationName, InitiatedByUser, TargetUser, InitiatedByIP,
          MethodType=tostring(RegisteredDetails.["Method Type"]),
          PhoneNumber=tostring(RegisteredDetails.["Phone Number"]),
          DeviceName=tostring(RegisteredDetails.["Device Name"])
| sort by TimeGenerated desc

4.2 Correlating MFA Registration with Anomalous Sign-In Risk

Detect authentication methods registered within 2 hours of an unfamiliar or risky sign-in event:

let RiskySignins = SigninLogs
| where TimeGenerated >= ago(7d)
| where ResultType == 0
| where NetworkLocationDetails has "Unknown" or RiskLevelDuringSignIn in ("high", "medium")
| project SigninTime=TimeGenerated, UserPrincipalName, SigninIP=IPAddress, SigninLocation=Location;
AuditLogs
| where TimeGenerated >= ago(7d)
| where OperationName == "User registered security info"
| extend TargetUser = tostring(TargetResources[0].userPrincipalName),
         AuditIP = tostring(InitiatedBy.user.ipAddress)
| join kind=inner (RiskySignins) on $left.TargetUser == $right.UserPrincipalName
| where TimeGenerated between (SigninTime .. (SigninTime + 2h))
| project TimeGenerated, TargetUser, AuditIP, SigninIP, SigninLocation, AdditionalDetails
| sort by TimeGenerated desc

4.3 Detecting Temporary Access Pass (TAP) Generation and Usage

Identify all TAP creation events across the tenant:

AuditLogs
| where TimeGenerated >= ago(30d)
| where OperationName has "temporary access pass"
| extend AdminUPN = tostring(InitiatedBy.user.userPrincipalName),
         AdminIP = tostring(InitiatedBy.user.ipAddress),
         TargetUser = tostring(TargetResources[0].userPrincipalName)
| project TimeGenerated, OperationName, AdminUPN, AdminIP, TargetUser, ResultDescription
| sort by TimeGenerated desc

---

5. Forensic PowerShell Audit & Remediation Playbook

5.1 Comprehensive User MFA Method Inspection Script

Audit all authentication methods registered on a targeted or compromised user account:

# Prerequisites: Microsoft.Graph.Identity.SignIns module
# Connect-MgGraph -Scopes "UserAuthenticationMethod.ReadWrite.All"

$targetUser = "victim@target.com"
Write-Host "[*] Auditing all authentication methods for: $targetUser" -ForegroundColor Cyan

# 1. Inspect Phone Methods
Write-Host "`n--- Registered Phone Numbers ---" -ForegroundColor Yellow
$phoneMethods = Get-MgUserAuthenticationPhoneMethod -UserId $targetUser
$phoneMethods | Select-Object Id, PhoneNumber, PhoneType, SmsState | Format-Table

# 2. Inspect Microsoft Authenticator Apps
Write-Host "`n--- Registered Microsoft Authenticator Devices ---" -ForegroundColor Yellow
$authMethods = Get-MgUserAuthenticationMicrosoftAuthenticatorMethod -UserId $targetUser
$authMethods | Select-Object Id, DisplayName, DeviceTag, CreatedDateTime | Format-Table

# 3. Inspect FIDO2 Security Keys
Write-Host "`n--- Registered FIDO2 Keys ---" -ForegroundColor Yellow
$fidoKeys = Get-MgUserAuthenticationFido2Method -UserId $targetUser
$fidoKeys | Select-Object Id, DisplayName, Model, CreatedDateTime | Format-Table

# 4. Inspect Active Temporary Access Passes
Write-Host "`n--- Active Temporary Access Passes (TAP) ---" -ForegroundColor Yellow
$taps = Get-MgUserAuthenticationTemporaryAccessPassMethod -UserId $targetUser
$taps | Select-Object Id, CreatedDateTime, StartDateTime, LifetimeInMinutes, IsUsableOnce, MethodUsabilityReason | Format-Table

5.2 Targeted Backdoor Purge & Session Invalidation Script

# Execute complete eradication of rogue methods
$targetUser = "victim@target.com"
$roguePhoneId = "31055a57-0910-4e4a-aa81-111111111111"
$rogueAppId = "8f3b6a9c-2d1e-4b5a-9f8e-7c6b5a4d3e2f"

# 1. Delete rogue phone number
Remove-MgUserAuthenticationPhoneMethod -UserId $targetUser -PhoneAuthenticationMethodId $roguePhoneId
Write-Host "[+] Rogue phone method removed." -ForegroundColor Green

# 2. Delete rogue Authenticator app
Remove-MgUserAuthenticationMicrosoftAuthenticatorMethod -UserId $targetUser -MicrosoftAuthenticatorAuthenticationMethodId $rogueAppId
Write-Host "[+] Rogue Authenticator instance removed." -ForegroundColor Green

# 3. Delete any active Temporary Access Passes
$activeTaps = Get-MgUserAuthenticationTemporaryAccessPassMethod -UserId $targetUser
foreach ($tap in $activeTaps) {
    Remove-MgUserAuthenticationTemporaryAccessPassMethod -UserId $targetUser -TemporaryAccessPassAuthenticationMethodId $tap.Id
    Write-Host "[+] Active TAP ($($tap.Id)) revoked." -ForegroundColor Green
}

# 4. Revoke active user sessions
Revoke-MgUserSignSession -UserId $targetUser
Write-Host "[+] All user session tokens revoked." -ForegroundColor Green

---

6. Cross-Reference & Investigation Navigation

• Previous Fiche: 29. OAuth Consent, Malicious Enterprise Apps & Service Principals
• Next Fiche: 31. Entra Directory Roles, PIM Abuse & Privilege Escalation
• Related Guides:
  • 02. Microsoft Entra ID: The Identity Plane
  • 09. Entra ID Sign-in Logs Analysis
  • 10. Entra ID Audit Logs Deep Dive
  • 12. Entra ID Protection & Risk Detection Forensics
  • 19. Microsoft 365 Account Compromise Kill Chain
  • 26. Microsoft 365 Cloud Persistence Taxonomy