Extending AD CS attack surface to the cloud with Intune certificates

Active Directory Certificate Services (AD CS) attack surface is pretty well explored in Active Directory itself, with *checks notes* already 16 “ESC” attacks being publicly…

A short excerpt. Read the linked source for the full article and context.

• Global AdministratorExplicit name or template GUID in this notice
• Global ReaderExplicit name or template GUID in this notice
• Intune AdministratorExplicit name or template GUID in this notice

Links open the current public role definition. A mention does not establish tenant impact, assignment, or historical permissions.

Monitored guidance in the same product area; this does not establish that the article cites each page.

• Intune built-in role permissions
• Intune admin center sign-up and URLs
• Intune changes and notices
• Intune in development
• Endpoint Privilege Management overview