Requesting Entra ID Tokens with Entra ID SSO Cookies

This report outlines a technique for leveraging a compromised Microsoft Entra ID SSO browser cookie to obtain OAuth tokens and enumerate a tenant in the absence of device PRTs. It provides a high-level process overview, introduces an automation tool to streamline token acquisition, and highlights that Conditional Access policies may still restrict success. The content focuses on TTPs rather than a specific incident, breach, or vulnerability disclosure.