Microsoft Detection and Response Team (DART) November 22, 2021 11 min read How to investigate service provider trust chains in the cloud This blog outlines DART’s recommendations for incident responders to investigate potential abuse of these delegated admin permissions, independent of the threat actor.