Graph API Token via Microsoft To-Do or Intune Portal Client ID Without MFA (CVE-2025-0309)
Detects ROPC (Resource Owner Password Credentials) token requests to Microsoft Graph using specific client IDs associated with Microsoft To-Do or Intune Company Portal. This activity could indicate an attempt to bypass MFA via hidden Conditional Access policy exclusions, as described in CVE-2025-0309.
Microsoft Sentinel (KQL)
