One stolen credential. Two platforms.
Full access.
How ITDR detects identity attacks across Entra ID and Okta
No malware. No exploits. Just a username, a password, and a clear path to the data behind them.
See how we track an identity-led intrusion stage by stage across Microsoft Entra ID and Okta, and exactly where each step gets flagged.
Get the guide
By submitting this form, I consent to ThreatDown or an authorized partner contacting me regarding products and services and using my personal data as described in the ThreatDown Privacy Policy.
What’s inside
This guide walks through a realistic identity-led intrusion, built around a simulation against a hybrid Microsoft Entra ID and Okta environment.
Five stages, one compromised account, and the exact signals ThreatDown Identity Threat Detection & Response (ITDR) uses to turn routine admin activity into a confirmed attack chain.
- Stage 1: A password spray across both platforms lands one working credential.
- Stage 2: Federation turns a single sign-in after hours into access to both platforms.
- Stage 3: An outside identity becomes a privileged insider in three steps.
- Stage 4: An API token, created outside business hours, opens a door built to stay open.
- Stage 5: One exfiltration path gets blocked. The other moves 200+ files and 7 archives, and ITDR flags the bulk download and mailbox access.
3 things security teams need to know
1
Federation is a lateral movement path siloed monitoring misses. One compromised Entra ID credential is a compromised Okta credential too, and the pivot needs no second password.
2
Every persistence step in this scenario used a legitimate feature. Three routine actions (an external invite, a guest-to-member conversion, and an admin role grant) took an outsider to a privileged insider. None of it involved malware.
3
The credential attack is the highest-value moment to catch the intrusion. By the time exfiltration starts, two persistence mechanisms are already locked in.
See the full attack chain, step by step
Get the eBook and follow the intrusion from the first failed login to the final exfiltration attempt, plus the takeaways security teams need to close the gap.