Requesting Azure AD Request Tokens

This research details how Windows 10 Accounts/BrowserCore and the MicrosoftAccountTokenProvider COM interface can be leveraged to obtain Azure AD refresh tokens and perform SSO impersonation on Azure AD–joined Windows hosts, then provides defensive telemetry (e.g., MicrosoftAccountTokenProvider.dll load patterns and a specific ETW provider GUID with example trace events) to detect such abuse, underscoring the importance of monitoring new credential sources on Azure AD–integrated endpoints.