User.Read-scoped token accessing privileged Graph API directory endpoints

Ibrahim Saud@tektrix

•updated Jun 24, 2026•5•0•22

Detects Microsoft Graph API enumeration of privileged directory endpoints using a token with only User.Read scope and password-only authentication (amr: pwd). This activity is consistent with the exploitation of CVE-2025-0309, often associated with tooling like AzureHound/roadtx, which abuses hidden Conditional Access exclusion policies.