OAuth Client ID Spoofing Used to Evade Telemetry in Microsoft Entra ID
Enforce strict client ID validation in Microsoft Entra ID to block OAuth client ID spoofing attacks.
Enforce strict client ID validation in Microsoft Entra ID to block OAuth client ID spoofing attacks.
Summary
Threat actors are weaponizing a novel evasion technique called OAuth client ID spoofing to bypass telemetry in cloud campaigns targeting Microsoft Entra ID environments. The technique allows attackers to enumerate user accounts and validate stolen credentials without generating a successful sign‑in event, thereby avoiding detection by standard monitoring tools. By spoofing the client ID, attackers can trick Entra ID into accepting forged authentication requests. The activity has been observed in multiple campaigns, raising concerns about the integrity of OAuth flows in cloud identity services. Microsoft has not yet released a patch but recommends enforcing stricter client ID validation to mitigate the risk.
Key changes
- OAuth client ID spoofing allows enumeration of user accounts
- Validates stolen credentials without generating sign‑in events
- Technique bypasses telemetry and monitoring
- Observed in multiple Microsoft Entra ID campaigns
- Microsoft recommends stricter client ID validation