PLAYBOOKSNETHOSTATTRIBDETECT
← all playbooks
INCIDENT TRIAGE · TIER 2
SaaS Tenant Hijack and OAuth Persistence
The identity provider itself is compromised. Not a single mailbox, not one user account: the Okta tenant, the Entra ID directory, the entire identity plane. The attacker controls who can authenticate, what permissions they have, and can create backdoor federation trusts that survive password resets and MFA changes.
IdP takeover · OAuth app persistence · shadow federation · cross-tenant sync · Global Admin audit · token revocation
This is not BEC. This is identity infrastructure compromise.

The BEC playbook covers a compromised mailbox. The Compromised Credentials playbook covers a stolen password. This playbook covers a fundamentally different scenario: the identity provider itself is the target. Scattered Spider's MGM attack compromised Okta. APT29 targets Entra ID tenants for OAuth persistence. When the IdP is compromised, every downstream application that trusts it is compromised too.

Clock-stopping priority. IdP compromise is the fastest path to total organizational compromise. Every minute the attacker has admin access to your identity provider, they can create new admin accounts, register persistent OAuth apps, modify federation trusts, and disable security controls. This is a "stop everything and contain" scenario.
Triage checklist
  1. 1. Terminate unauthorized admin sessions immediately Revoke all active sessions for compromised admin accounts via the IdP's token revocation API. In Entra ID: Revoke-AzureADUserAllRefreshToken. In Okta: clear all sessions via Admin API. Force re-authentication for all Global/Super Admin accounts. Do not wait for session expiry. Entra ID: Revoke-AzureADUserAllRefreshToken · Okta: /api/v1/users/[id]/sessions DELETE
  2. 2. Audit Global Administrator and privileged role assignments Enumerate every account with admin roles. Check for: recently added Global Admins, Privileged Role Admins, or Application Admins. Check for role assignments that bypassed PIM (Privileged Identity Management) activation. Any admin role granted during the compromise window is suspect until verified. Entra ID: directory audit logs for roleAssignments · Okta: System Log for privilege grants
  3. 3. Enumerate all Enterprise Applications added in the blast-radius window Attackers register malicious OAuth apps or consent to rogue third-party apps to maintain persistent access. Search for: new Enterprise Application registrations, OAuth consent grants (especially "admin consent" that applies org-wide), and apps with high-privilege permissions (Mail.ReadWrite, Directory.ReadWrite.All, Files.ReadWrite.All). Revoke consent for any unauthorized app. Entra ID: Enterprise Applications audit · BEC playbook (OAuth section)
  4. 4. Check for shadow federation and backdoor IdPs APT29 and Scattered Spider both create backdoor federation trusts. Search for: new SAML/OIDC/WS-Federation identity provider configurations, modified federation domain settings, and new trusted certificate configurations. A shadow federation trust allows the attacker to mint valid tokens from their own infrastructure indefinitely, surviving password resets, MFA changes, and account disablement. Entra ID: Get-MgDomainFederationConfiguration · APT29 (Golden SAML)
  5. 5. Review cross-tenant synchronization rules In multi-tenant environments, attackers modify cross-tenant sync to propagate their access from one tenant to others. Check for: new cross-tenant access policies, modified inbound/outbound trust settings, and B2B collaboration configurations that grant external tenants admin-level access. Entra ID: cross-tenant access settings · B2B collaboration audit
  6. 6. Audit conditional access policy modifications Attackers weaken or disable conditional access to maintain their access. Check for: policies modified to exclude admin accounts from MFA requirements, new "break glass" exclusions added during the compromise window, and policies disabled entirely. Restore all conditional access policies to pre-compromise state. Entra ID: Conditional Access audit log · Policy backup comparison
  7. 7. Rotate all IdP signing certificates and keys If the attacker accessed SAML signing certificates or token signing keys, they can forge tokens indefinitely. After containing the compromise: rotate all SAML/token signing certificates, rotate all application secrets and certificates, and invalidate all existing tokens org-wide. This is disruptive. It is also necessary. Entra ID: token signing certificate rotation · Okta: key rotation
Related playbooks

Compromised Credentials (single account compromise, not IdP takeover)
Business Email Compromise (mailbox-level compromise with OAuth overlap)
Scattered Spider (Okta admin takeover is their signature)
APT29 (Golden SAML, OAuth app abuse, tenant hijacking)
Cloud Control Plane (IdP is the cloud control plane)