4. Global Reader and Path Review¶

Authenticate as the target principal¶

Convert the recovered PKCS#12 material into the certificate and private-key format required by the authentication workflow demonstrated by the instructor. Authenticate using:

• the workshop tenant ID;
• the application/client ID for svc-global-reader; and
• the recovered client certificate and private key.

Confirm that the new token represents svc-global-reader. It must not represent either guest account or the diagnostics VM managed identity.

Validate the objective¶

Use a read-only Microsoft Graph request from the workshop workflow to verify that the principal can perform an operation allowed by its tenant-wide Global Reader directory role. Confirm the active tenant before making the request and do not make directory changes.

Reconstruct the complete path¶

Use your Cirro graph and collected evidence to explain every transition:

Public signup
  -> guest identity
  -> dynamic group membership
  -> subscription Reader
  -> exposed diagnostics VM
  -> command execution
  -> VM managed identity
  -> Key Vault data-plane access
  -> client certificate
  -> svc-global-reader
  -> Global Reader

Create a final Attack Path tab in CirroDash. Add:

• a table card containing the complete path query used in the workshop;
• a count card for the number of distinct identities in the path; and
• a table card listing each relationship type in traversal order.

Test each query, keep the results limited to the authorized scenario, and use clear column aliases so another analyst can understand the evidence without editing the query.

For each edge, record the evidence that proves it and the control that would break it. Your remediation discussion should address account creation, dynamic membership, broad resource visibility, public workload exposure, command construction, managed-identity permissions, privileged credential storage, and exportable certificates.