Sysdig Details Azure Tenant Takeover via Leaked Service Principal Secret

Jul 14, 2026 · Original article ↗

Summary

Sysdig says an attacker used a leaked Azure service-principal secret to gain Global Administrator and root-level access, harvest keys, and add credentials to 26 app registrations, exposing visibility gaps across five Azure permission planes.

Key points

Sysdig says the service-principal secret was exposed for about two weeks before the observed abuse; sign-ins came from rotating VPN, Tor exit, and hosting infrastructure.
The attacker reportedly gained Global Administrator in about two and a half minutes by using the service principal’s existing Microsoft Graph RoleManagement.ReadWrite.Directory permission.
The attacker then used elevateAccess to obtain User Access Administrator at the root scope and assigned itself Owner-class access at subscription scope.
The reported activity included harvesting keys from four storage accounts and two Event Hub namespaces, and adding access policies to three Key Vaults.
Attacker-controlled client secrets were added to 26 application registrations for persistence; Sysdig says one was later reused to confirm the backdoor worked.
The investigation found access spread across Entra roles, Azure RBAC, Key Vault policies, bearer keys, and Graph API permissions, with separate views and logs complicating impact analysis.
Sysdig says immutable off-tenant logs enabled reconstruction, while data-plane diagnostics were absent for the affected storage accounts and Event Hubs; it recommends cross-plane monitoring, credential inventory, and disabling shared keys where possible.

Article Details

Attack Vectors: Initial access used a leaked Azure service-principal client secret that had been exposed for about two weeks.
The service principal's admin-consented Microsoft Graph permission, RoleManagement.ReadWrite.Directory, enabled it to assign itself Global Administrator.
The attacker used Microsoft.Authorization/elevateAccess/action to grant User Access Administrator at the Azure root scope, then self-assigned an Owner-class role at subscription scope.
The attacker retrieved storage account keys and Event Hub root keys, and added itself to Key Vault access policies and role assignments before reading secrets.
The attacker added attacker-controlled client secrets to 26 application registrations to establish persistence.
Defensive Notes: Review permissions across Entra directory roles, Azure RBAC, resource-local policies, bearer keys, and Graph API application permissions.
Inventory service-principal credentials and Graph permissions; monitor credential additions and restrict high-risk permissions such as RoleManagement.ReadWrite.Directory.
Alert on elevateAccess, privileged role grants, Key Vault access-policy changes, role assignments, and listKeys or SAS issuance.
Disable shared-key access where possible and prefer identity-based data-plane authorization.
Enable and route Entra audit and sign-in logs, Microsoft Graph activity logs, Azure Activity logs, and resource data-plane diagnostics before an incident.
Keep durable copies of logs in immutable, off-tenant storage and correlate events across permission planes by identity.