3 OAuth TTPs Seen This Month — and How to Detect Them with Entra ID Logs

This report examines how attackers exploit OAuth mechanisms in Azure Entra ID—specifically the device code flow and ROPC—to obtain access tokens, bypass MFA, and establish durable persistence through device registration and Windows Hello for Business. It outlines observable patterns in sign-in telemetry, highlights prevalent misconfigurations in Conditional Access, and supplies ready-to-use KQL queries to detect device-code phishing, ROPC-based brute force and MFA bypass, and suspicious device/WHfB registrations.