AzureHound Entra Tenant Enumeration via Overpermissioned Graph Token (CVE-2025-0309)

Ibrahim Saud@tektrix

•updated Jun 24, 2026•3•0•17

Detects bulk enumeration of Microsoft Graph API endpoints (users, groups, devices, service principals) characteristic of tools like AzureHound or roadtx. The detection focuses on high-frequency GET requests originating from known Edge browser client IDs associated with CA policy bypass (CVE-2025-0309) where tokens lack MFA claims, indicating unauthorized reconnaissance in an Azure/Entra ID environment.