BSides Cheltenham 2026

Jack McBride will be presenting: From Domain Admin to Global Admin

This session explores how trust relationships between on-premises Active Directory and Microsoft Entra ID can transform a traditional domain compromise into a broader cloud security incident.

The talk focuses on several high-impact attack paths observed during recent red team engagements. These include abuse opportunities involving AZUREADSSOACC$, password synchronisation infrastructure, cloud-connected applications, and credentials or secrets exposed through source code repositories and commit history.

Rather than concentrating on tooling, the session examines the underlying trust relationships that make these attack paths possible and why they are frequently overlooked during security assessments. Real-world examples will be used to illustrate how attackers can identify and exploit these opportunities, followed by practical defensive recommendations for reducing risk and improving visibility.