Listen to this Post
Introduction:
Microsoft’s Seamless Single Sign-On (Seamless SSO) has long been a cornerstone for hybrid identity environments, but it is now a deprecated legacy feature posing a critical security risk. This protocol relies on decryptable Kerberos tickets, creating a potent lateral movement vector from on-premises Active Directory to Entra ID (Azure AD). Threat actors can easily fingerprint its presence via open-source intelligence (OSINT), making it a prime target for sophisticated identity-based attacks.
Learning Objectives:
- Understand the critical security flaws inherent in the legacy Seamless SSO mechanism.
- Learn to audit your environment for Seamless SSO dependencies and active usage.
- Execute a secure migration plan to modern, PRT-based authentication.
You Should Know:
1. OSINT Fingerprinting for Seamless SSO
Threat actors can passively confirm if your tenant uses Seamless SSO without triggering alarms by querying a public Microsoft endpoint.
Command:
Check if a tenant has Seamless SSO enabled via its public endpoint curl -s "https://autologon.microsoftazuread-sso.com/tenantname.com/winauth/ssoprobe?version=2" | grep -i "works"
Step-by-step guide:
This curl command queries a well-known Microsoft endpoint specific to Seamless SSO, replacing `tenantname.com` with your domain. A response containing “works” indicates the feature is active. This is a non-intrusive check that attackers use for reconnaissance. Defenders should run this against their own domains to understand their public exposure.
2. Auditing Kerberos Service Tickets on Domain Controllers
The primary method to validate internal usage is by auditing Kerberos service ticket requests (TGS-REQs) made by the Seamless SSO computer account, AZUREADSSOACC.
Command (Windows PowerShell):
Query Event Logs on Domain Controllers for TGS requests from the AZUREADSSOACC$
Get-WinEvent -FilterHashtable @{LogName='Security'; Id='4769'; Data='AZUREADSSOACC$'} -MaxEvents 100 | Select-Object -Property TimeCreated, Message
Step-by-step guide:
This PowerShell command queries the Security event log on a Domain Controller for events with ID 4769 (A Kerberos service ticket was requested). It filters these events to show only those where the service name is the Seamless SSO account. A high volume of recent events indicates active dependency, meaning you cannot disable the feature yet without causing user authentication failures.
3. Identifying Non-Compliant Devices with Microsoft Graph
Before disabling Seamless SSO, you must identify devices that are not Hybrid Azure AD Joined, as these are the most likely to be relying on the legacy protocol.
Command (Microsoft Graph API):
Use Microsoft Graph API to list all devices that are NOT Hybrid Azure AD Joined curl -H "Authorization: Bearer <ACCESS_TOKEN>" "https://graph.microsoft.com/v1.0/deviceManagement/managedDevices?`$filter=joinType ne 'hybridAzureADJoined'"
Step-by-step guide:
This Graph API call requires an OAuth2 access token with the `Device.Read.All` permission. It filters the device management list to show all devices whose `joinType` is not hybridAzureADJoined. These devices, often legacy VDI clients or kiosks, are prime candidates for still using Seamless SSO and must be remediated first.
4. Extracting the AZUREADSSOACC Decryption Key (Mimikatz)
The core security risk lies in the Kerberos decryption key of the `AZUREADSSOACC` account. Attackers with domain admin privileges can extract this key and forge tickets to access cloud resources.
Command (Mimikatz):
mimikatz privilege::debug mimikatz lsadump::secrets /name:AZUREADSSOACC$
Step-by-step guide:
This Mimikatz command sequence first elevates privileges (privilege::debug) and then dumps the LSA secrets, specifically targeting the `AZUREADSSOACC$` computer account. The output will include the Kerberos keys (e.g., AES256, RC4) for that account. A threat actor who compromises a domain controller can use these keys to decrypt any Kerberos ticket issued for Seamless SSO, demonstrating the critical lateral movement path.
5. Forging Kerberos Tickets for Cloud Access
With the extracted key, an attacker can craft a silver ticket to impersonate a user and request a token for Entra ID.
Command (Mimikatz):
mimikatz kerberos::golden /user:fakeuser /domain:contoso.com /sid:S-1-5-21-... /rc4:<AZUREADSSOACC_RC4_KEY> /service:HTTP /target:autologon.microsoftazuread-sso.com /ticket:azureadsso.kirbi
Step-by-step guide:
This “golden ticket” attack forges a Kerberos ticket (silver ticket in this context) for the service principal HTTP/autologon.microsoftazuread-sso.com. The `/rc4` parameter uses the NT hash of the `AZUREADSSOACC$` account obtained in the previous step. The resulting ticket file (azureadsso.kirbi) can be used with tools like Rubeus to authenticate to Entra ID and gain access to cloud applications as the impersonated user.
6. Mitigation: Disabling Seamless SSO in Entra Connect
The definitive mitigation is to disable the feature via the Entra Connect configuration wizard.
Step-by-step guide:
- Backup: Ensure you have a current backup of your Entra Connect server.
- Launch: Run the Entra Connect installation wizard from your server.
- Configure: Select Customize synchronization options and click Next.
- Sign-in: Enter your Global Administrator credentials when prompted.
- Disable: On the User sign-in page, UNCHECK the box for Enable single sign-on.
- Complete: Proceed through the remaining screens and finalize the configuration. This change will disable the endpoint and remove the immediate attack vector.
7. Monitoring for Post-Disable Authentication Failures
After disabling Seamless SSO, monitor for authentication failures to catch any misconfigured applications or devices you missed in the audit phase.
Command (KQL – Azure Sentinel/Microsoft Defender):
SigninLogs | where ResultType == "50125" or ResultDescription has "InvalidSeamlessSsoConfiguration" | project TimeGenerated, UserPrincipalName, AppDisplayName, IPAddress, ResultDescription
Step-by-step guide:
This Kusto Query Language (KQL) query runs in Azure Sentinel or Microsoft Defender to surface sign-in failures specifically related to a misconfigured or disabled Seamless SSO. Error code `50125` often corresponds to this issue. Monitoring these logs post-disablement allows for targeted troubleshooting and ensures a smooth transition for all users.
What Undercode Say:
- Legacy Identity Systems are the New Crown Jewels. Attackers are shifting focus from exploiting software vulnerabilities to abusing misconfigured legacy identity protocols. Seamless SSO represents a perfect storm: it’s widely deployed, poorly understood, and offers a direct path from on-prem to cloud.
- Validation Precedes Mitigation. Disabling a critical authentication mechanism without comprehensive auditing is a business disruption risk. The provided auditing commands are not just diagnostic; they are essential for building a risk-based migration plan. The key is to move with precision, not speed.
The analysis of this threat reveals a broader pattern in modern cybersecurity: the architectural debt of hybrid identity. Many organizations built their cloud foundations years ago on then-best practices that have since been deprecated. The ongoing challenge is continuously auditing and modernizing these identity bridges, which are often invisible until they are exploited. This isn’t just about disabling a feature; it’s about managing the entire lifecycle of your identity providers.
Prediction:
The deprecation of Seamless SSO will catalyze a wave of identity-focused attacks throughout 2024 and 2025. Threat actors, particularly ransomware groups, will weaponize automated tools to scan for and exploit this vulnerability at scale. This will lead to a significant increase in cloud account takeovers originating from compromised on-premises environments, forcing a industry-wide reckoning with legacy hybrid identity configurations. Organizations that fail to migrate will face not only direct compromise but also increased scrutiny from regulators over poor identity hygiene, potentially impacting cyber insurance eligibility and compliance status.
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Jeffrey Appel – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
