Detecting OAuth Token Theft

When to Use

Investigating alerts for impossible travel or anomalous token usage in Microsoft Entra ID
Responding to a suspected session hijacking or pass-the-cookie attack
Configuring proactive defenses against OAuth token theft in an Azure/M365 environment
Detecting OAuth device code phishing campaigns that bypass MFA
Analyzing sign-in logs for token replay indicators
Implementing Token Protection conditional access policies to bind tokens to devices

Do not use for on-premises Kerberos ticket attacks (pass-the-ticket, golden ticket); use Active Directory-specific investigation techniques for those scenarios.

Prerequisites

Microsoft Entra ID P2 license (required for Identity Protection risk detections and conditional access)
Global Administrator or Security Administrator role in the Entra admin center
Microsoft Defender for Cloud Apps (MDCA) license for session anomaly detection
Access to Entra ID Sign-in Logs and Audit Logs (Diagnostic Settings to Log Analytics or Sentinel)
Familiarity with OAuth 2.0 authorization flows (authorization code, device code, client credentials)

Workflow

Step 1: Understand the Token Theft Attack Surface

Key token types and theft vectors:

Token Type	Lifetime	Theft Vector	Impact
Access Token	60-90 min	Memory dump, proxy interception	API access for token lifetime
Refresh Token	Up to 90 days	Browser cookie theft, malware	Persistent access
Primary Refresh Token	Session-based	Mimikatz, AADInternals	Full SSO to all M365/Azure apps
Session Cookie	Varies	XSS, AitM proxy	Full session hijacking

Enable Identity Protection to flag anomalous token usage:

Entra Admin Center > Protection > Identity Protection > Risk Detections

Key risk detections for token theft:
- Anomalous Token        : Unusual token characteristics
- Token Issuer Anomaly   : Token from unusual issuer
- Unfamiliar Sign-in     : New location for user
- Impossible Travel      : Geographically impossible sign-ins
- Malicious IP Address   : Known malicious source

Configure risk-based conditional access:

Policy: "Block High-Risk Sign-ins"
  Users: All users (exclude break-glass accounts)
  Conditions: Sign-in Risk = High
  Grant: Block access

Policy: "Require MFA for Medium-Risk"
  Conditions: Sign-in Risk = Medium
  Grant: Require MFA + password change

Step 3: Enable Token Protection

Bind sign-in session tokens to device TPM:

Entra Admin Center > Protection > Conditional Access > New Policy

Policy: "Enforce Token Protection"
  Users: Pilot group (expand after validation)
  Cloud Apps: Office 365 Exchange Online, SharePoint Online
  Conditions: Device Platforms = Windows
  Session: Require token protection for sign-in sessions
  Grant: Require compliant or Hybrid Azure AD joined device

KQL queries for Microsoft Sentinel or Log Analytics:

// Detect anomalous token usage
SigninLogs
| where TimeGenerated > ago(7d)
| where RiskDetail contains "token" or RiskEventTypes_V2 has "anomalousToken"
| project TimeGenerated, UserPrincipalName, IPAddress, Location,
          RiskDetail, RiskLevelDuringSignIn, AppDisplayName
| sort by TimeGenerated desc

// Detect impossible travel with token reuse
SigninLogs
| where TimeGenerated > ago(7d)
| where ResultType == 0
| summarize Locations=make_set(Location), IPs=make_set(IPAddress),
            Count=count() by UserPrincipalName, bin(TimeGenerated, 1h)
| where array_length(Locations) > 1

// Detect device code flow abuse (phishing)
SigninLogs
| where TimeGenerated > ago(7d)
| where AuthenticationProtocol == "deviceCode"
| project TimeGenerated, UserPrincipalName, IPAddress, Location, AppDisplayName

Step 5: Investigate and Respond

# Revoke all refresh tokens for compromised user
Connect-MgGraph -Scopes "User.ReadWrite.All"
Revoke-MgUserSignInSession -UserId "user@contoso.com"

# Force password reset
Update-MgUser -UserId "user@contoso.com" -PasswordProfile @{
    ForceChangePasswordNextSignIn = $true
}

# Review and revoke malicious OAuth app consent grants
Get-MgUserOauth2PermissionGrant -UserId "user@contoso.com"
Remove-MgOauth2PermissionGrant -OAuth2PermissionGrantId "<grant-id>"

# Check for mail forwarding rules (common post-compromise action)
Get-MgUserMailFolderRule -UserId "user@contoso.com" -MailFolderId "Inbox" |
    Where-Object { $_.Actions.ForwardTo -ne $null }

Step 6: Enable Continuous Access Evaluation (CAE)

Entra Admin Center > Protection > Conditional Access > Continuous Access Evaluation
  Strictly enforce location policies: Enabled

CAE triggers near-real-time token revocation when:
- User account disabled/deleted
- Password changed/reset
- Admin explicitly revokes tokens
- Identity Protection detects elevated risk

Key Concepts

Term	Definition
Primary Refresh Token (PRT)	Long-lived device-bound token providing SSO to all Azure AD apps
Token Protection	Conditional access feature binding tokens to device TPM
Continuous Access Evaluation	Near-real-time policy enforcement on token revocation
AitM (Adversary-in-the-Middle)	Phishing that proxies auth flow to capture session cookies post-MFA
Device Code Flow	OAuth grant for input-constrained devices; abused in phishing campaigns

Verification

Identity Protection risk detections generating alerts for anomalous tokens
Conditional access policies block high-risk sign-ins and require MFA for medium-risk
Token Protection confirmed working (test from unregistered device fails)
KQL queries return results against synthetic anomaly events
CAE enabled and verified (revoke session, confirm access blocked within minutes)
Incident response runbook includes token revocation and OAuth consent review

6.3 KiB Raw Blame History