Entra App Registration with External-Auth Callback Redirect URI

Ibrahim Saud@tektrix

•updated Sep 23, 2026•1•0•4

Detects the modification or creation of Azure AD applications that include specific malicious redirect URIs associated with 'TrustSink' style attacks, which abuse external authentication callback mechanisms to intercept tokens and bypass MFA.