Review Cloud Hardening Gaps After Identity Compromise
Review identity-plane and cloud-control-plane weaknesses that allowed attacker persistence or tenant abuse, including conditional access, service principals, OAuth grants, and AKS control-plane visibility.
Actions
- 1
Document every tenant control that failed or was bypassed: MFA coverage gaps, weak conditional access scoping, stale break-glass accounts, excessive app consent, and unmanaged workload identities.
- 2
Review all service principals, managed identities, and OAuth grants touched during the incident. Remove unnecessary permissions and add monitoring for privileged credential changes.
- 3
Assess Azure infrastructure logging coverage, including AKS diagnostic settings, Kubernetes audit retention, resource-level activity logs, and ACR access telemetry.
- 4
Define a hardening backlog for conditional access, application governance, workload identity restrictions, and cloud admin break-glass procedures.
Queries
AuditLogs | where TimeGenerated > ago(30d) | where OperationName has_any ("Add service principal credentials", "Consent to application", "Add member to role") | project TimeGenerated, OperationName, InitiatedBy, TargetResourcesAzureActivity | where TimeGenerated > ago(30d) | where ResourceProvider has "Microsoft.ContainerService" or ResourceProvider has "Microsoft.ContainerRegistry" | summarize count() by OperationNameValue, Caller, ResourceGroup
Notes
Cloud hardening reviews should include workload identity and cluster control-plane telemetry, not just user account abuse.
If AKS or container services are in scope, missing audit settings are evidence gaps that need explicit remediation owners.