hard20 pts · first answer countscloud-identityincident-response

Password reset did not stop the attacker

A user approved a fake "PDF Viewer" app that requested Mail.Read and offline_access permissions in Microsoft Entra ID. After a password reset, mail is still being read. Why?

A.The app holds its own OAuth consent and refresh tokens, which a password reset does not revoke; remove the app grant and service principalB.The password reset has not replicated yetC.MFA was turned off by the resetD.The mailbox has a corrupt index that leaks mail

Discussion 0

Join free to post in the discussion.

Password reset did not stop the attacker

Discussion 0

Related questions