New OAuth Attack Lets Hackers Bypass Microsoft Entra Authentication and Steal Keys

ConsentFix is a newly reported OAuth 2.0-based attack that tricks users into exposing authorization codes from Microsoft Entra ID first-party apps (e.g., Azure CLI); attackers then redeem those codes to obtain access, ID, and refresh tokens, potentially bypassing Conditional Access and device compliance checks. The report documents forensic detection via correlated SessionId values between the victim’s interactive sign-in and the attacker’s non-interactive redemption, enumerates affected Microsoft first-party tools, and recommends mitigations such as explicit service principal assignment, Conditional Access restrictions, and enabling Microsoft Entra Token Protection (WAM).