Original webinar at Altered Security
In this Altered Security webinar, I looked at how attackers can turn an initial identity compromise into longer-term access by registering passkeys in Azure. The session covered registration and authentication flows, attested device-bound versus synced passkeys, and Entra ID configuration choices that influence attack feasibility.
I also explored the use of captured credentials or session tokens to register passkeys and obtain access across Azure services, including automated activity. The defensive discussion focused on detection opportunities, incident response, and remediation, with particular attention to persistence that password resets or session revocation alone may leave behind.
