While most attacks against cloud identities still rely on traditional password-based techniques, such as password spraying, credential stuffing, and brute-force attacks, these methods have become less effective as multi-factor authentication (MFA) has become more widespread. As a result, attackers are increasingly turning to token-based techniques, including token theft, adversary-in-the-middle (AiTM) attacks, device code phishing, and ConsentFix, which get around MFA instead of trying to break it.
As one of the most widely deployed identity platforms, Microsoft Entra ID is a prime target for these evolving attack techniques. This raises the question: how well does its defense-in-depth strategy actually hold up against this shift? We put it to the test.
Today we are releasing our newest white paper: ERNW White Paper 80: Token Theft in Microsoft Entra ID - An Analysis of Controls.
Short Abstract
This paper evaluates Entra ID’s defenses against token-based attacks, with a focus on Continuous Access Evaluation (CAE), Token Protection, and OAuth 2.0 compliance. Empirical testing across the platform surfaced three key findings:
- CAE coverage is thin. Only 33 of 740 analyzed first-party resource providers support Continuous Access Evaluation, and where it is supported, revocation times vary widely, from 10 seconds (SharePoint/Teams) to 5 minutes (Exchange).
- Token Protection can be partially bypassed in its default configuration, via User-Agent manipulation or by falling back to a web client.
- Entra ID still deviates from current OAuth 2.0 best practices in several places: reliance on proprietary mechanisms (PRT, FOCI, BroCI), coarse-grained scopes, limited BFF adoption, continued support for deprecated grant types, and no refresh token rotation for public clients.
If you’re responsible for securing a hybrid or cloud-native identity environment, this paper is likely worth your time. Several of the findings translate directly into controls you can evaluate and implement today.
Cheers!
P.S.: This paper will be followed by a 4-part blog series. Over these four posts, we’ll walk through how token-based attacks work, put important Microsoft defenses gaining relevance in this context (Continuous Access Evaluation and Token Protection) through empirical testing, and check where Entra ID deviates from OAuth 2.0 best practices.
Upcoming trainings from ERNW instructors:
- Entra ID Security Essentials training in August, September and November.
- Hardening Microsoft Environments training in October and December.
See also this blog post: Insights into Entra ID’s (Un)Conditional Access