Managed identities are widely used in Azure to eliminate credential management, but in my experience, they can introduce significant risk when exposed through misconfigurations or accessible endpoints.
In this talk, I show how Azure serverless resources—including Logic Apps, Function Apps, and Automation Accounts—can be abused to extract managed identity access tokens. I walk through realistic attack paths where an attacker with limited initial access can retrieve a token and use it to interact with Azure APIs, enabling lateral movement and access to other resources.
I demonstrate how these attacks work in practice using a recorded demo, highlighting the key steps involved in moving from initial access to meaningful impact within an environment.
Finally, I will cover practical defensive strategies I’ve found effective, including scoping managed identities appropriately, restricting access to exposed endpoints, and improving monitoring to detect token abuse.