{"repo":"zh54321/PoCEntraDeviceComplianceBypass","free":true,"listed":false,"github":"https://github.com/zh54321/PoCEntraDeviceComplianceBypass","clone":"git clone https://github.com/zh54321/PoCEntraDeviceComplianceBypass.git","description":"Simple pure PowerShell POC to bypass Entra / Intune Compliance Conditional Access Policy","language":"PowerShell","stars":169,"topics":["entra","entraid","pentesting","pentesting-tools","poc","powershell","redteaming"],"license":null,"category":"security-tools","readme_excerpt":"POCEntraDeviceComplianceBypass A Conditional Access Policy in Entra ID which only require a compliant device can be bypassed using Intune Portal client. Note that any other Conditional Access Policies and conditions you’ve configured in your tenant will still apply! Update February 2024: Microsoft changed the pre-consented scopes on the Azure AD Graph API (user impersonation -- Service PrincipalEndpoint.Read.All,User.Read). Therefore, it is not possible anymore to run tools like ROADrecon. How To Manual Approach using poc entra compliance bypass.ps1 1. Execute the script. 2. Open the Browser Developer tools and authenticate normally. 3. After clicking on \"Continue\" you should see an error message in the Browser console: 4. Click on the URL in the Browser console (ms-appx-web://...) this will open the URL in a new tab. Copy the content of the code parameter into the script window. This will get you an access and refresh token (stored in $token): The refresh token can, for example, be used to obtain an access token for Azure AD Graph. Using Entra Token Aid If you don’t want to hassle with copying things manually, you can simplify the process by using EntraTokenAid (https://github.com/zh54321/EntraTokenAid.git): Credits - For the write-up: TokenSmith – Bypassing Intune Compliant Device Conditional Access by JUMPSEC - For discovery and sharing: - TEMP43487580 (@TEMP43487580) - Presentation: https://i.blackhat.com/EU-24/Presentations/EU-24-Chudo-Unveiling-the-Power-of-Intune-Lever","default_branch":null,"files":null,"tree":[],"storefront":"/r/zh54321","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/zh54321/PoCEntraDeviceComplianceBypass/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}