Best practices Incident response Microsoft Entra Published Nov 22, 2021 11 min read How to investigate service provider trust chains in the cloud This blog outlines DART’s recommendations for incident responders to investigate potential abuse of these delegated admin permissions, independent of the threat actor.