Enabling Burp Suite DAST to access your Entra ID groups - Port Swigger

Summary: PortSwigger documentation describes how Burp Suite DAST users who are not using SCIM can map local DAST groups to Entra ID groups by selecting the Customize the name of the group claim checkbox and entering the claim values. If the Entra ID application already sends group membership under a different claim, that claim name is entered in Burp Suite DAST instead of adding a claim to Entra ID, and permissions are granted by setting the Identity provider group value on each local group.
Bottom line: Group-to-role mapping is where access control actually lives: if the claim name in Entra ID and the value configured on each local Burp Suite DAST group don't line up, users either land without the permissions they need or inherit group access nobody intended.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026