Azure AD Security Bypass Exploits Phantom Device Registration and PRT Abuse

### Executive summary: This report describes a red-team discovery that phantom device registration at the Device Registration Service (DRS) and Primary Refresh Token (PRT) abuse can fully bypass Microsoft Entra ID (Azure AD) Conditional Access and Intune compliance checks, enabling tenant takeover (including Global Administrator accounts) without touching corporate endpoints; researchers reproduced the chain in a production tenant and linked similar activity to the Storm-2372 APT.