Threat Research
Categories
- Active Directory Backup & Recovery (69)
- Active Directory Security (245)
- AD Security 101 (18)
- Agentic AI (13)
- Community Tools (26)
- Crisis Management (5)
- Directory Modernization (10)
- From the Front Lines (71)
- Hybrid Identity Protection (99)
- Identity Attack Catalog (32)
- Identity Security Research Library (10)
- Identity Threat Detection & Response (175)
- Our Mission: Be a Force for Good (15)
- Purple Knight (6)
- Semperis University (5)
- The CISO's Perspective (19)
- Threat Research (91)
- Uncategorized (3)
Agent ID: Understanding Microsoft’s Agent Identity Platform
- Semion Vasilevitzky and Jonathan Elkabas
- Jun 30, 2026
Microsoft’s Entra Agent ID and the agent identity platform are about to become a major theme in identity and security conversations. Learn how this platform enables you to discover, manage, monitor, and secure AI agent identities.
The Taxonomy of Workload Identities in Entra ID: Service Principals, Enterprise Applications, and Other Forms of Organized Confusion
- Semion Vasilevitzky and Jonathan Elkabas
- Jun 26, 2026
The term workload identity describes multiple types of non-human identities in Entra ID. In this chapter of our guide to preventing agent identity attacks, dive into the distinctions between workload identity types and discover the newest type: ServiceIdentity.
Meet Entra ID Agent Identities (BTW: They’re Not People)
- Semion Vasilevitzky and Jonathan Elkabas
- Jun 26, 2026
Non-human identities already far outnumber human identities. Learn how the Entra ID agent identities defined by Microsoft fit into the Authentication, Authorization, and Accounting model that governs our digital landscape.
Understanding and Preventing Entra ID Agent Identity Attacks: A Comprehensive Guide
- Semion Vasilevitzky and Jonathan Elkabas
- Jun 26, 2026
Developed by the Semperis research team, this multi-part guide helps organizations understand how Microsoft approaches human and non-human identities in Entra ID—and how to protect these critical assets from threat actors.
What You Need to Know: Windows Admin Center Remote Privilege Escalation (CVE-2026-26119)
- Andrea Pierini
- Mar 23, 2026
Learn about the discovery of CVE-2026-26119: why it worked and why you shouldn't underestimate authentication reflection.
SyncJacking: Hard Matching Vulnerability Enables Entra ID Account Takeover
- Tomer Nahum
Attackers with certain privileges can abuse Entra Connect hard matching synchronization to take over synchronized Entra ID accounts.
nOAuth Abuse Update: Potential Pivot into Microsoft 365
- Eric Woodruff | Chief Identity Architect
Additional nOAuth research indicates that the risk of nOAuth abuse still exists and that many organizations are still unaware of this vulnerability.
Exploiting Ghost SPNs and Kerberos Reflection for SMB Server Privilege Elevation
- Andrea Pierini
When misconfigured Service Principal Names (SPNs) and default permissions align, attackers can exploit Kerberos reflection to gain SYSTEM-level access remotely. Even with Microsoft’s security update, Ghost SPNs can still haunt you. Learn why.
