Executive Summary
Researchers have identified a significant vulnerability in how Microsoft Graph API handles Conditional Access (CA) policies and token scopes. When an administrator adds any exclusion to an 'All resources' CA policy, Microsoft automatically applies hidden exclusions for certain low-privileged scopes. This allows attackers with compromised username/password credentials to obtain valid tokens for Microsoft Graph without satisfying MFA or device compliance requirements.
Technically, tokens obtained via specific clients like Microsoft Edge (f44b1140-bc5e-48c6-8dc0-5cf5a53c0e34) exhibit a 'scope creep' behavior. While the token JWT claims only limited 'User.Read' permissions, the backend brokerage allows for full tenant enumeration, including users, groups, devices, and service principals. This effectively permits tools like AzureHound to map an entire organization's directory despite appearing to have minimal access.
This matters because it undermines the 'Zero Trust' architecture of Entra ID. Organizations relying on blanket MFA policies with even a single app exclusion (e.g., for Intune onboarding or specific legacy apps) are vulnerable to stealthy reconnaissance and iterative password spraying from unauthenticated or single-factor positions.