Unpacking the AAD Broker LocalState Cache

This technical post maps the Azure AD Broker (Entra ID) LocalState cache, reverses its packing/encryption (UTF-8 BOM + version tag, Base64 ASN.1 DPAPI/CNG, zlib), and documents JSON vs. custom binary serialization used for PRT and per-application authority files; it demonstrates how to decrypt/unpack these caches to recover PRT session key material and JWTs, and highlights security risks including potential silent token renewal and long-lived access when attackers have local SYSTEM/TPM-bound key access, as well as the reconnaissance value of exposed identity, application, and token metadata.