The adversaries leverage administrative privileges obtained during the on-premise compromise to access the victim’s global administrator account and/or trusted SAML token-signing certificate.