Cpe:2.3:a:microsoft:entra_id_hybrid_health:*:*:*:*:*:*:*:*

Threat actors can register unauthorized server instances within the Microsoft Entra ID (formerly Azure AD) Hybrid Health AD FS service to spoof signing logs and bypass authentication monitoring.