Primary Refresh Tokens Aren’t Your Parent’s Browser Token

This article explains Microsoft Primary Refresh Tokens (PRTs), how they are issued and stored to enable long-lived single sign-on across Microsoft Entra/Azure AD environments, and why attackers increasingly target them. It outlines common abuse paths—privileged token extraction (e.g., Mimikatz), unauthorized reuse, and device code phishing via platforms like Teams or WhatsApp—and emphasizes that PRTs can bypass conditional access. Recommended mitigations include preventing elevated device access, adopting phishing-resistant authentication, and validating unexpected access or device-approval requests.