AiTM Feed - Conditional Access

Written By John Fitzpatrick

This post details how to utilise the Lab539 Adversary in The Middle service in order to subscribe to the conditional access service and benefit from a real time updated named location feed.

If you are not already a subscriber then you can subscribe here. The conditional access service requires the Defender package.

Video Setup Guide

Permissions

The following inbuilt roles will suffice for any account you wish to register with the service:

Application Administrator, Conditional Access Administrator

If you would like to specify roles then these are the permissions the service requests:

  • Policy.ReadWrite.ConditionalAccess

  • Policy.Read.All

In addition we request an offline access scope in order that we can update the named location without requiring you to authenticate each time:

  • scope=offline_access

Accounts

You do not need to use the account that you registered for the AiTM feed subscription with. Within the portal you have the ability to specify the account you would like to use for this aspect of the service. As long as the account has the required permissions it will function:

Image showing a text box where a username can be specified for the service
John Fitzpatrick https://www.lab539.com
Previous

File Hosting Services Used for Identity Phishing
Next

Using Conditional Access Policies to Block Tor Exit Nodes in Entra ID