How to Find MFA Bypasses in Conditional Access Policies

Conditional access policies allow organizations to create fine-grained controls over how MFA is applied during authentication to Microsoft services such as Microsoft 365 and Azure. Occasionally, configurations are made that enable single factor access in certain scenarios. As an external attacker who compromises a credential it may be possible to discover these MFA inconsistencies. As an organization managing conditional access policies each one should be checked regularly to ensure loopholes aren't being unintentionally created. This video demonstrates tools that can be used to find potential single factor access conditions in conditional access policies.
Links:
What are Conditional Access Policies? learn.microsof...
MFASweep: github.com/daf...
ROADTools: github.com/dir...
Breaching the Cloud Training: www.antisyphon...

[@meazer]

great video. very well-condensed and no needless tangents. so many other people would've made this video 30 mins long. this is perfect, keep it up.

[@jmedoestech]

Very informative video. I'm 100% going to be replicating this / testing a couple of scenarios myself. Thank you for sharing this knowledge 👍 Keep up the good work!

[@michaelwaterman3553]

Wow, this is great info! Going to share with my team on Monday. Big thanks!

[@owensben]

Very well presented and straight to points with demos, nice work!
Shows the importance of a policy which blocks access all operating systems but allows connections from operating systems which you supported, such as iOS, Android, Windows and MacOS. Like the tools you showed and thanks for sharing.
Subscribed.

[@PaulLinger]

This is a great video. Appreciate you creating the tool, will def be leveraging tomorrow morning lol.

[@melonscratcher]

Hey Beau - Great video! First time I watched your content and I do like it a lot! Skills to pay the bills, keep it rolling. SUBSCRIBED !!!

[@michaelrogers2011]

Solid breakdown, thanks Beau.

[@SumanRoy.official]

Wonderful video, totally an uncommon topic , subbed

[@cgaz9088]

Great video, great tool, a great addition to my toolbox! Thanks for the hard work

[@user-eu2yf6ij2t]

Yeah, I'm gonna need nobandwidth intro music bro ;)

[@user-ty3iy8bk2l]

Amazing video. Exactly what I was looking for.
Subbed

[@nattsvart199]

Great video. Please do more mfa hacking and protecting.

[@ajmaddox1540]

Beau - the account that was 'compromised' for your example and that you utilized to do your MFA sweep -- was it elevated at all? any admin permission roles?

[@pelicansurfs]

Curious about this as well

[@MrJoeyverlinden]

Can't find the device emulation mode in my (fully patched) Edge browser. How did you open it? 🤔

[@eslamkamal1704]

Great content as usual 👏👏
what is the best way to perform OPSEC during Azure Pentesting for example!!

[@LukePWilkinsVids]

Brilliant information! Thank you

[@prisa1590]

Very interesting! Nice video.

[@hullan666]

Hi! I have built some CA policies that I'm pretty sure are watertight but just wanted to check with this script. However, I get a "Login appears to have failed" on almost all the logins? The Graph API and the Azure mgmt API are the two only ones that give me the green text with "the response indicates MFA is in use"

[@swarajshubham007]

I want to bypass MFA under trusted IP network. Set conditional access policy and added my IP as trusted ip still facing the MFA prompt.

[@patrick__007]

A great video. Thanks voor sharing.

[@GisselleGuzman-pk8ui]

hehehhe it's WORKING!! :) THANKS!! for creating this powershell script ..liked and subscribed

[@anonymous-zi1pw]

hi can you help me authenticate my account?

[@Zachsnotboard]

so if you were to use -UsersPermissionToReadOtherUsersEnabled FALSE , would this keep tools like MFA sweep from getting this info ?

[@BVey-tt6wl]

What privileges did the (breached) account hold?

[@australiansango]

Great video.

[@vicariousphoto]

Spreadin them sheets 😎

[@arjanvanveen3312]

Is there a way to bypass my antivirus? This script contains malicious content and has been blocked by your antivirus software.

[@MichaelToub]

Great Video!!

[@patrick__007]

Can you do this in bulk? Instead per user per group per instance

[@nmelanson75]

Does not work for me for Import I get a The ampersand (&) character is not allowed.

[@socbrian]

Thanks for the video and tool. What if the company uses a federation service like Ping/Okta, I assume your tool wouldn't support that as the fields to stuff username / password would be different than MS's login screens

[@wunderwuzzi3113]

Common misconfig includes ROPC working (e.g. MFA enforced at identity provider, but not in AAD) - so ROPC attack works and AAD gives out access token.

[@anonymous-zi1pw]

hi bro, did you get how to authenticate mfa? i need help

[@jackl8499]

Cool

[@lewiskelly14]

The title should be clearer that this is for cloud and doesn't apply to Windows Server

[@Boolap1337]

Cool