Replayed refresh-token session survives password reset via non-interactive Graph access

Ibrahim Saud@tektrix

•updated Aug 3, 2026•2•0•7

Detects continued non-interactive Microsoft Graph session activity for a user account from an IP address different from the one used during a password reset event, consistent with replayed refresh-token or session-cookie material persisting through credential rotation.