OAuth2 client_credentials token request to login.microsoftonline.com with hardcoded app credentials

Duo Tech@duotech

•updated Jul 21, 2026•5•1•14

Detects HTTP POST requests to the Microsoft login endpoint for OAuth2 tokens using the client_credentials grant type, where the request body contains evidence of hardcoded client_secret parameters and specific scopes. This behavior often indicates an application or script with embedded, potentially leaked or insecurely stored, credentials being used to authenticate against Microsoft cloud services.