OAuth Client ID Spoofing Bypasses Entra ID Sign-In Detection at Scale

Attackers are abusing Microsoft Entra ID's OAuth authentication flow by submitting requests with spoofed client IDs, allowing them to enumerate valid usernames and test credentials without triggering standard sign-in alerts. Because the technique exploits how error responses differ between valid and invalid accounts, it effectively turns Microsoft's own authentication feedback against defenders. This matters because millions of accounts across thousands of tenants have already been targeted, and the method evades many traditional detection controls such as failed sign-in thresholds. The widespread independent adoption by multiple threat actors signals that this has become a reliable, low-friction credential harvesting technique.

Tactical Insight

Immediate actions

Enable Microsoft Entra ID's Conditional Access policies to restrict authentication attempts from untrusted locations, devices, and unknown client applications.
Audit OAuth application registrations and enforce strict allowlisting of approved client IDs within your tenant.
Enable and review Entra ID sign-in logs and risky sign-in alerts for anomalous OAuth client ID patterns.

Long-term improvements

Enforce phishing-resistant MFA (e.g., FIDO2/passkeys) across all accounts to reduce the value of successfully harvested credentials.
Implement a zero-trust identity strategy that continuously evaluates authentication context rather than relying solely on password correctness.
Establish a regular OAuth application review process to detect unauthorized or suspicious client registrations.

Detection measures

Integrate Entra ID sign-in logs with your SIEM and create alerts for high volumes of authentication errors tied to unrecognized or unknown client IDs.
Deploy a threat intelligence feed to correlate known malicious OAuth client IDs and IP ranges against your authentication telemetry.
Configure User and Entity Behavior Analytics (UEBA) to baseline normal OAuth usage patterns and flag deviations at scale.

Framework References

CIS Control 5 – Account ManagementCIS Control 6 – Access Control ManagementCIS Control 8 – Audit Log ManagementNIST SP 800-53 AC-2 (Account Management)NIST SP 800-53 AC-17 (Remote Access)NIST SP 800-53 IA-5 (Authenticator Management)NIST SP 800-53 AU-6 (Audit Review, Analysis, and Reporting)NIST SP 800-207 (Zero Trust Architecture)MITRE ATT&CK T1586.003 – Compromise Accounts: Cloud AccountsMITRE ATT&CK T1078.004 – Valid Accounts: Cloud AccountsGDPR Article 32 – Security of ProcessingOAuth 2.0 Security Best Current Practice (RFC 9700)

Source

ThreatNoir coverageMillions of Microsoft Entra Accounts Targeted in OAuth Client ID Spoofing Campaigns Read originalMillions of Microsoft Entra Accounts Targeted in OAuth Client ID Spoofing Campaigns

PublishedJul 14, 2026