For the second path, the attackers create their own SAML signing certificate outside of the organization’s environment. With Azure AD administrative permissions, they then add the new certificate as a trusted object. As these are rare actions, we advise verifying that any instances identified are the result of legitimate administrative activity