# Entra ID and Active Directory researcher

Source: https://startwithidentity.com/experts/dirk-jan-mollema/
Last updated: 2026-09-20
License: content by Start with Identity. Cite the source URL.

---

## Bio

Dirk-jan Mollema researches Microsoft identity from the outside and writes the tooling to prove his findings: ROADtools for Entra ID, mitm6 and krbrelayx for relay attacks, adidnsdump and ldapdomaindump for enumeration, and the Python port of BloodHound. He has disclosed critical vulnerabilities across Active Directory, Windows, and Entra ID, and runs Outsider Security.

Profile built from public research, project, and vendor-acknowledgement records.

## Where their work shows up

Hybrid identity is where most enterprises are exposed, and it is the seam his research keeps opening: what a synchronization account can actually do, how a foothold on-premises becomes tenant-wide access in the cloud, and which Conditional Access policies do not hold under specific protocol paths. That work turned into real product hardening and into the detection logic [ITDR](https://startwithidentity.com/guides/fundamentals/what-is-itdr/) tools now ship. See [primary refresh token theft](https://startwithidentity.com/techniques/primary-refresh-token-theft/), [federation trust abuse and SAML forgery](https://startwithidentity.com/techniques/federation-trust-abuse-saml-forgery/), and [cross-tenant token confusion](https://startwithidentity.com/techniques/cross-tenant-token-confusion/).