## 6 Evaluation and Discussion
### Discussion  
This paper investigates the causes and risks associated with privilege escalation attacks on Microsoft Azure Active Directory due to configuration errors. A replicable laboratory environment was created using Microsoft Azure and Azure Active Directory, incorporating all security features to simulate the infrastructure of a software company. Realistic scenarios were implemented, including options to fulfill users' requirements, such as remote access to specific virtual machines. Through these simulations, it was observed that a hacker could elevate their privileges vertically and horizontally within the system, even without exploiting any software bugs. This experience highlights the significance of proper configuration, as a single misconfiguration can have substantial consequences for an organization, prompting a reevaluation of the reliance solely on the principle that SaaS is protected by the service provider.  
Prior research and industry observations have revealed that the facilitation of user processes and the automation of tasks were primary motivations behind privilege escalation attacks. In the first scenario, the dynamic group feature was activated to expedite and automate the granting of access to new users. In the second experiment, the managed identity feature was employed to streamline authentication between the virtual machine and the required resources. Despite being classified as an additional layer of protection, inadequate preparation of these features rendered them vulnerable. System administrators were often unaware of the severity of these errors, as they occurred unintentionally. Their intention was not to introduce vulnerabilities to the system, but rather to enhance user efficiency by not specifying the scope of assigned roles. Consequently, system administrators must possess comprehensive knowledge of security aspects.  
Azure Active Directory provides numerous configuration options, and their combinations can yield countless outcomes. As the system grows, the complexity of these options increases, leading to a higher likelihood of configuration errors and vulnerabilities. Considering that the present research adopts a hacker's perspective, the following question arises: Which factors contribute to the inclusion of misconfiguration vulnerabilities that enable privilege escalation attacks, and how does the assessment differ among organizations?  
To address this question, the research employs the CCSS standard to assess configuration weaknesses and their associated risk implications. The assessment of weaknesses considers three fundamental values: exploitability, impact, and base. Exploitability determines the ease and conditions for exploiting a vulnerability, impact assesses the consequences for the organization, and base provides an overall evaluation of the vulnerability. The adoption of this standard aims to measure the threats associated with configuration errors, which often differ significantly from typical vulnerabilities. This discrepancy arises from the varied settings, privileges, services, and errors that may exist within an organization, as well as the extent of their impact. During the second experiment, the effect levels of integrity and confidentiality were set to \"Complete\" when the virtual machine's privileges were exploited at the subscriber level. If the device's permissions are confined to a specific range, the effect becomes \"Partial\", reducing the impact value from nine to two. While the privilege level of the virtual machine itself did not directly influence the successful execution of the privilege escalation attack, the privilege level of the user played a role. Therefore, while the vulnerability resulting from misconfigurations in the managed identity feature may exist across multiple organizations, its evaluation score may differ based on specific circumstances.