Spoofed Exchange Online AppId Prefix Used in ROPC Enumeration

Duo Tech@duotech

•updated Jul 14, 2026•0•0•4

Detects the use of spoofed Exchange Online Application IDs in Azure sign-in logs. Attackers use these specific spoofed AppID patterns to bypass controls during Resource Owner Password Credential (ROPC) authentication, often for user enumeration purposes.