Azure AD Conditional Access Bypassed Via Phantom Device Registration and PRT Abuse
Cloud identity security relies heavily on Microsoft Entra ID (formerly Azure AD) Conditional Access. It acts as the primary digital gatekeeper, checking user locations, calculating risk scores, and verifying device health before granting access. However, an authorized red team engagement by Howler Cell recently revealed a critical attack path that entirely bypasses these vital protections. […] The post Azure AD Conditional Access Bypassed Via Phantom Device Registration and PRT Abuse appeared first on Cyber Security News.
Attackers bypassed Azure AD Conditional Access protections by registering phantom devices and abusing Public Reputation Tracking (PRT), allowing unauthorized access to cloud resources. This vulnerability exploits the trust model of Microsoft Entra ID, which relies on device health checks and risk scores.
Read the full article
This is a curated summary. The complete article is available at Cyber Security News.