How could I have had an attacker compromise my AVD session host using admin account whose SID does not match in Entra?

The incident details described are not directly covered in the context, but the context does provide guidance on how to investigate and validate what happened using Microsoft Entra sign-in logs, Conditional Access, and ID Protection. The key is to verify whether the activity truly came from the admin accounts in question, and how it bypassed or did not trigger the expected controls.

A practical investigation path based on the context:

1. Verify Conditional Access behavior for the admin accounts
   • Sign in to the Microsoft Entra admin center as at least a Reports Reader.
   • Go to Entra ID → Monitoring & health → Sign-in logs.
   • Filter on:
     • Username = the two admin accounts.
     • Date = time window of the incident.
     • Conditional Access = Failure and Success.
   • For each sign-in event around the time of the attack, open the event and select the Conditional Access tab to see:
     • Which policies applied.
     • Whether any policy was Blocked by Conditional Access (error code 53003).
   • Use the Troubleshooting and support tab on the sign-in event to see the exact reason for any failure (for example, device not compliant, location blocked, etc.). This helps confirm whether the France-origin activity should have been blocked by the “Australia-only” policy and whether that policy actually applied to those accounts.
2. Check for unusual or risky sign-in patterns on the admin accounts
   • In the same sign-in logs, review:
     • Location/IP changes: look for sign-ins or failed authentications from France or other non-approved regions.
     • Failed authentications from countries/regions you don’t operate out of by filtering on Location = <unapproved location>.
     • Failures blocked by Conditional Access using Error code = 53003 and Failure reason = blocked by Conditional Access.
   • For privileged accounts specifically, monitor:
     • Sign-in failure, bad password threshold (Status = Failure, error code = 50126).
     • Failure because of Conditional Access requirement (Status = Failure, error code = 53003, Failure reason = Blocked by Conditional Access).
     • Account lockout (Status = Failure, error code = 50053).
   • These checks help determine whether the attacker was attempting password spray, brute force, or was blocked by policies but still generating alerts.
3. Use ID Protection to assess user and sign-in risk
   • Configure and review Microsoft Entra ID Protection sign-in risk and user risk policies.
   • Ensure policies such as “block users if risk = high” are in place for admin accounts.
   • Use ID Protection to investigate whether the admin accounts were flagged with elevated risk around the time of the incident, which would indicate compromise even if the sign-in behavior appears normal at a glance.
4. Correlate AVD session host activity with Entra sign-ins
   • For each AVD session host alert, correlate the timestamp and account name with Entra sign-in events:
     • Confirm whether there is a matching interactive sign-in from the admin account at that time.
     • If the SID in the AVD alert does not match Entra or on-prem, use the sign-in logs to confirm whether the identity used was a cloud-only account, a different UPN, or a mis-attributed identity.
   • If the AVD alert shows activity from France, verify whether the corresponding Entra sign-in event shows the same location or if there is a discrepancy (for example, VPN or proxy causing different geo resolution).
5. Review Conditional Access configuration for gaps
   • Confirm that the “Australia-only” Conditional Access policy:
     • Explicitly includes the two admin accounts (or the groups they belong to).
     • Applies to the AVD-related applications/resources used by those admins.
   • If the policy does not apply to the resource or the accounts, sign-ins from France could be allowed even though the policy exists.
6. Monitor for MFA fraud and other compromise indicators on the admin accounts
   • In the sign-in logs, monitor MFA fraud alerts:
     • Status = failed and Details = MFA Denied.
   • For privileged accounts, also monitor:
     • MFA fraud alert or block in sign-in logs and audit logs (Result details = MFA denied, fraud code entered; Activity type = Fraud reported).
   • Any fraud reports from the admins would strongly indicate that someone else was trying to use their credentials.
7. If device compliance or managed device policies are involved
   • If Conditional Access requires compliant or managed devices for admin access to AVD, investigate whether:
     • The session hosts or admin devices fell out of compliance (causing blocked sign-ins).
     • Unknown devices were used to access AVD, which could indicate attacker-controlled infrastructure.
   • Use the Affected entities view in the relevant scenario to see impacted users and then drill into their profiles and sign-in activity.

These steps will not directly explain the SID mismatch, but they will validate whether the admin accounts were truly used, how the France-origin activity appeared, and whether Conditional Access and ID Protection behaved as expected or exposed a configuration gap.

References:

• Microsoft Entra security operations for user accounts
• Security operations for privileged accounts in Microsoft Entra ID
• How to investigate the sign-ins requiring a compliant or managed device alert
• Troubleshoot sign-in problems with Conditional Access