Entra ID ROPC Enumeration via Malformed UUID Client ID with Blank App Fields

Duo Tech@duotech

•updated Jul 14, 2026•0•0•5

Detects Microsoft Entra ID authentication attempts (Resource Owner Password Credentials - ROPC) where the Client ID and Application Display Name are blank. This pattern is indicative of attackers attempting to enumerate users or bypass security controls by using malformed or spoofed client identification in authentication requests.