Attackers Don’t Need Your Devices Anymore They Just Need Your Identity.

This report details an "identity-plane" lateral movement technique in which attackers steal a user’s credentials/session token via phishing, use Graph API enumeration to map a tenant, register a service principal (or add credentials) to gain non-human access, and then read/send mail or access files from other users—all without compromising endpoints. It defines a five-stage kill chain (compromise, permission discovery, pivot, cross-identity access, action on objective), lists Defender XDR telemetry sources (MicrosoftGraphActivityLogs, CloudAppEvents, IdentityLogonEvents), and provides multiple KQL detection queries and correlation strategies to identify reconnaissance, suspicious app registrations/credential additions, dormant service-principal credential drops, and anomalous application access patterns.