Azure AD PRT Phantom Device CA Bypass Without TPM Attestation

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•2

Detects anomalous Primary Refresh Token (PRT) issuance for non-compliant, non-hybrid joined devices that do not utilize TPM attestation, followed by immediate access to high-value Microsoft resources like Microsoft Graph, Exchange, or SharePoint. This activity is indicative of the Storm-2372 Conditional Access bypass technique, where attackers register 'phantom' devices to circumvent security policies.