Tycoon Entra Token Used through a Non-Interactive Client

Daniel Jeremiah@daniyyell

•updated Jun 21, 2026•1•0•6

Detects a session issued through browser MFA and subsequently used through a non-interactive, mobile, or command-line client. This behavior is indicative of an adversary potentially using a stolen session token to bypass multi-factor authentication.