Detection of Unauthorized Device Registration in Microsoft Entra ID

Adversaries are increasingly using unauthorized device registration to maintain long-term access to Microsoft Entra ID environments. By registering a new device to a user account, attackers can obtain a Primary Refresh Token (PRT), effectively bypassing certain session-based controls and maintaining persistence as a valid, albeit unauthorized, user. This technique is particularly effective because it allows attackers to blend in with legitimate traffic by appearing as a registered device within the cloud environment. Attackers often utilize first-party client IDs and legitimate OAuth workflows to perform this registration. Defenders must monitor for sign-in activity originating from non-managed, previously unseen devices, as these often serve as the first indicator of a compromised or manipulated cloud identity. This activity is frequently associated with phishing for authentication codes or broader OAuth workflow exploitation.

Impact

Successful device registration enables attackers to gain persistent access, facilitate token theft, and perform post-compromise activities like API data exfiltration. This behavior has been observed in campaigns targeting Microsoft 365 environments, where the final objective is the acquisition of persistent cloud sessions that survive password resets or typical session expirations.

Recommendation

Detection teams should focus on identifying anomalous device associations for user accounts.

• Implement monitoring for sign-in events involving devices not identified as managed, specifically those that are not hybrid-joined.
• Configure alerts for new combinations of user accounts and device IDs, as provided by the new-terms detection logic.
• Review Entra ID sign-in logs for unexpected incoming_token_type values, particularly primaryRefreshToken usage from unknown device_id entries.
• Enforce conditional access policies that restrict device registration to compliant or enrolled hardware.