Skip to content
Threat Feed
Subscribe

Tag

User_impersonation

1 brief RSS
medium advisory

Entra ID OAuth User Impersonation Scope for Unusual User and Client

Adversaries may abuse the user_impersonation OAuth scope in Entra ID to gain unauthorized access to user accounts, especially when combined with single-factor authentication and unbound sign-in sessions, potentially indicating account compromise for users not seen in the last 10 days.

Entra ID azure oauth user_impersonation initial_access defense_evasion
2r 3t