{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/identity-threat/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Microsoft Entra ID","Microsoft Graph"],"_cs_severities":["medium"],"_cs_tags":["cloud-security","identity-threat","privilege-escalation","persistence"],"_cs_type":"advisory","_cs_vendors":["Microsoft"],"content_html":"\u003cp\u003eThis threat brief describes a detection pattern for unauthorized Microsoft Graph API usage. It correlates non-interactive Microsoft Entra ID sign-ins (asserting managed, Azure AD joined device context and an Edge user agent) with subsequent activity where the exact access token is used by a scripted client to query at least three distinct directory-enumeration paths in Microsoft Graph. This approach utilizes the unique token identifier to correlate activity, rather than relying on session identifiers.\u003c/p\u003e\n","date_modified":"2026-11-03T15:16:44Z","date_published":"2026-11-02T15:08:37Z","id":"https://feed.craftedsignal.io/briefs/2026-11-entra-id-graph-enumeration/","summary":"Identification of a pattern where a non-interactive Microsoft Entra ID client sign-in, characterized by managed device context and an Edge user agent, is followed by the use of the same access token by a scripted client to perform directory enumeration via Microsoft Graph.","title":"Microsoft Entra ID: Managed Device Client Sign-In to Graph Enumeration","url":"https://feed.craftedsignal.io/briefs/2026-11-entra-id-graph-enumeration/"}],"language":"en","title":"CraftedSignal Threat Feed - Identity-Threat","version":"https://jsonfeed.org/version/1.1"}