CA Policy Exclusion Abuse - MFA Bypass via Hidden Scope Exclusion (CVE-2025-0309)

Ethan Andrews@eandrews

•updated Jun 24, 2026•2•0•7

Detects sign-in events where Conditional Access was not applied for Microsoft Graph access using low-privileged client IDs known to trigger hidden CA exclusions. Tokens issued with only single-factor authentication to Graph indicate exploitation of the hidden scope exclusion behavior introduced when any exclusion is added to an 'All resources' CA policy (CVE-2025-0309). Additionally, this rule identifies audit log events for Conditional Access policy modifications that add exclusions.