Deprecating Azure AD Graph API is Easy and Other Lies We Tell Ourselves

No ratings

Presented at Bluehat / BlueHat India 2024 by

Nestori Syynimaa

Azure AD Graph API and AzureAD PowerShell module were introduced in 201x to replace the MSOnline PowerShell module utilizing a “provisioning API”. In 2019, we announced that AzureAD and MSOnline modules and their back-end APIs will deprecate by June 2020. However, the deprecation date has been postponed multiple times ever since. Both PowerShell modules have been deprecated as of March 30, 2024, but the back-end APIs are still functional until June 30, 2025. In April 2024, we announced the general availability of Microsoft Graph activity logs, which allows our customers to identify activities conducted by compromised accounts and other problematic behaviours of applications. However, these logs are not available for Azure AD Graph API. For this reason, adversaries likely keep using Azure AD Graph API with compromised user identities until its deprecation. This talk covers the history of the Azure AD Graph API, sheds light on why its deprecation has been so difficult, how to migrate to MS Graph API, and finally, how to detect & prevent malicious Azure AD Graph API usage.