Microsoft Fixed Entra Conditional Access Bypass via Nested App Authentication
Summary
NetSPI found that certain Nested App Authentication flows could bypass Entra Conditional Access when issuing Microsoft Graph tokens. The exploit required an Azure Portal refresh token; Microsoft has since fixed the issue.
Key points
- The bypass affected Nested App Authentication token exchanges for Microsoft Graph, allowing access tokens to be issued without Conditional Access evaluation.
- Three affected applications were identified: ADIbizaUX and two Microsoft Intune portal extensions.
- An attacker first needed an Azure Portal refresh token, obtainable through phishing or access to a victim’s credentials and MFA material.
- The Azure Portal refresh token had a fixed 24-hour lifetime and could not be extended indefinitely, limiting the exploitation window.
- The tested bypass did not work for Azure Resource Manager tokens; comparable Microsoft Teams FOCI token refreshes were blocked by Conditional Access.
- NetSPI reported the issue to Microsoft, which classified it as medium severity and rolled out a fix.
- NetSPI’s post-patch testing confirmed that Conditional Access blocked token requests through all three affected applications.
Article Details
- Vulnerability Types
- Conditional Access policy bypass through Nested App Authentication
- Severity
- Medium
- Exploitation Status
- reported
- Exploit Availability
- public_poc
- Patch Status
- available
MITRE ATT&CK
T1528 · Steal Application Access TokenThe article describes obtaining and using a compromised Azure Portal refresh token to acquire Microsoft Graph access tokens.T1566 · PhishingThe article identifies phishing as a possible way to obtain the initial Azure Portal refresh token needed to exploit the bypass.
People
Vendors
Products
Azure PortalNAA is Microsoft’s SSO framework across the M365 and Azure ecosystem, designed to allow “host” applications such as the Azure Portal to act as authentication brokers for nested/ child applications.Microsoft 365More organizations are adopting Conditional Access Policies (CAPs) to strengthen their Azure and Microsoft 365 environment.Microsoft Entra IDCAPs are widely regarded as a foundational control in Microsoft Entra ID, giving organizations the ability to enforce a range of authentication requirements across their Azure and Microsoft 365 environments.Microsoft GraphHowever, NetSPI discovered that it was possible to bypass Microsoft Entra Conditional Access Policies by abusing Nested App Authentication to return access tokens for the Microsoft Graph API.Microsoft IntuneMicrosoft Intune for Education portal extension – f52f5287-0be2-4052-83e8-e69620aa67ccMicrosoft TeamsOne example of a FOCI-enabled client is Microsoft Teams.OutlookThis enables the authentication to be brokered by any Microsoft 365 supported host application it’s configured to run in such as, Teams or Outlook etc.