Security publication · MA Technology Services, LLC
EntraMigrator platform: pre-GA security audit, adversarial exercise and architectural remediation
Redacted public summary of an internal report. Internal report dated 19 May 2026, version 3. Published 17 October 2026. Author: Max Armah, founder and principal architect. Scope: the EntraMigrator SaaS management plane and agent, 8 to 19 May 2026.
- Subject
- EntraMigrator, our enterprise product for migrating Windows devices from on-premises Active Directory to Microsoft Entra ID without a reimage. The agent runs with system privilege on enterprise endpoints; the management plane serves large enterprise fleets, including fleets of 120,000 and 60,000 endpoints.
- Why it was done
- Pre-general-availability gate. Two areas had been scored as release blockers: operator identity trust in the administrative API, and the package build and signing chain.
- What this page omits
- Endpoint paths, header and configuration names, finding mechanics, commit identifiers and customer identities. The full report is available to qualified organizations under NDA and to program reviewers on request.
Method
Five phases over eleven days, each leaving its own evidence trail.
1. Static review, ten rounds
Each round: independent static review of the source against Azure Well-Architected, NIST SSDF and OWASP SCVS; triage into bounded change requests; implementation and deployment; re-review. More than forty security commits across the ten rounds.
2. Adversarial exercise
A chartered, cold-start exercise against the production reference tenant with no prior context: defined hypotheses, attacker personas, required deliverables and explicit halt conditions. Organized in lanes covering reconnaissance, external probing, privilege escalation, a compromised endpoint and lateral movement. Halted on the first critical finding per the charter.
3. Containment and remediation
Immediate configuration containment, then code-level fail-closed guards, then defense-in-depth changes, then a final sweep of every authorization path.
4. Architectural sprint A6
Operator identity to the administrative API rebuilt on cryptographically signed, short-lived assertions instead of a shared secret plus a caller-supplied identity.
5. Architectural sprint A7
Package build chain rebuilt so the build container holds no storage credentials and the API independently verifies every artifact's signature before it is accepted.
Findings and timeline
Counts and outcomes. Mechanics are withheld.
Critical findings
The adversarial exercise produced three critical findings. The first was reached in seventeen minutes and was a runtime configuration condition, not a code defect: three independent controls had each drifted, and only their combination created the exposure. The other two concerned excessive privilege on build infrastructure and a weak trust anchor for administrative operator identity.
Timeline
- Critical finding identified: 15 May 2026
- Contained (configuration reverted, secret rotated, services restarted): within 4 hours
- Remediated in code (fail-closed guards deployed, forged identity rejected): within 24 hours
- Architectural fixes for the remaining two findings: completed in sprints A6 and A7 by 19 May 2026
Controls that held
- Agent authentication hierarchy
- Command lease tokens with replay protection
- Stateful enrollment tokens
- Installer configuration validation (no injection achieved)
- Constant-time administrative credential comparison
- Private-endpoint enforcement on direct hostnames
- Production security flags, all non-overridable
What changed
Seventy-four or more security commits across the eleven days. The structural changes:
Fail closed everywhere
Thirty-one fail-closed guards across the customer-facing functions; zero fail-open authorization patterns remain. Startup guards reject unsafe configuration before the service accepts traffic. Anonymous requests receive an authentication error, not an empty success.
Signed operator assertions (A6)
The administrative dashboard signs five-minute assertions with a certificate held in a key vault it can use but not export; the administrative API can verify but not sign. Assertions carry audience, issuer, expiry, issue time and a single-use nonce. Legacy identity forwarding is rejected in production and can only be re-enabled by a governed, expiring break-glass setting that requires a reason and an approver.
Credential-free build chain (A7)
The build container receives no storage credentials. The API brokers every file in and out through authenticated callbacks with single-use job tokens. Golden binaries are verified against a per-file hash manifest. Signing status is never trusted from the builder; the API performs its own Authenticode verification against a pinned signer. Container images are pinned by digest. A signing failure is fatal, never a silently unsigned build.
Posture at close, and what remained
Internal scoring on a ten-point scale, by area, at 19 May 2026.
- Customer API identity defense
- 8.7
- Agent authentication, command and log integrity
- 8.6
- Tenant fail-closed guards
- 8.5
- Package build and signing (A7)
- 8.4, from 5.5
- Dashboard and real-time channel authentication
- 8.1
- Administrative API identity (A6)
- 8.0 or higher, from 5.0
- Enrollment security
- 8.0
- Administrative RBAC logic
- 7.7
- Support grant model
- 7.0
Work carried into the next phase: separating the signing broker from the builder, cryptographic signing of the golden manifest, walking back build-runner identity privileges, platform-level authentication registration for the customer API, a seven-state support-grant lifecycle, a distributed replay store for assertion nonces, signature timestamp validation, and supply-chain evidence (tests, SBOM, static analysis in CI).
Lessons we kept
Static review is necessary, not sufficient
Ten rounds hardened the code. The live exercise found what review could not: configuration drift that silently broke a trust boundary.
Configuration is attack surface
The most critical finding was not a code bug. Application settings and cloud role assignments get the same rigor as source, and startup guards that refuse to run on bad configuration are the primary defense.
Depth, not a single gate
The critical finding needed three independent failures. All three layers were fixed, so no single regression can recreate it.
Fix the trust anchor, not the symptom
Rotating a leaked secret is containment. Replacing a shared secret with signed, expiring assertions is remediation.
Questions about this publication or requests for the full report: max@armah.ai.