Entra ID AADSTS700016 unauthorized_client Indicating Valid Credentials Without Sign-in
Detects Microsoft Entra ID authentication failures (AADSTS700016) where a client ID is provided that does not exist in the directory. This error often indicates attackers attempting to spoof legitimate OAuth client applications to perform reconnaissance or bypass conditional access policies.
Sigma
