VerdantBamboo M365 Conditional Access Bypass via Compromised Edge Appliance Proxy

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

Detects successful Microsoft 365 user authentications where Conditional Access (CA) policies were bypassed, resulting in single-factor authentication. This pattern is indicative of attackers using compromised edge network appliances—which are often configured as trusted network locations—to proxy authentication requests and circumvent security controls.