Security ResearchM42 Labs

Building secure IAM & PAM by day. Testing boundaries by night.

We are deeply knowledgeable engineers who push the boundaries of the systems we implement. By understanding Microsoft Entra ID, Intune, BeyondTrust, and other IAM/PAM platforms beyond what the documentation tells us, we uncover vulnerabilities and build more secure environments for our clients.

View our CVEs Contact us

Who We Are

Security research, driven by engineering.

Modern 42 Labs is the security research division of Modern 42. Our team combines deep expertise in IAM and PAM technologies with a passion for understanding how they work at a fundamental level.

Security Experts

Specialised in discovering and responsibly disclosing vulnerabilities in enterprise security systems.

Engineering Excellence

Our engineers don't just use technology, we understand how it works at the deepest levels.

Research Driven

Continuous research into IAM, PAM, authentication systems, and access control mechanisms.

Featured Discovery

Latest Security Research

Our most recent vulnerability write-up on Microsoft's enterprise identity platform.

m42-labs, advisory/latest.vuln

labs@m42:~/advisories $ cat latest.vuln

---

VULN-154544

Important

Fixed

target: Entra ID Conditional Access

reported: May 2025

class: MFA Bypass

Entra ID Conditional Access MFA Bypass via First-Party OAuth Clients

A Conditional Access policy targeting All resources with any single app exclusion let a stolen username and password bypass the policy's MFA and device compliance requirements and acquire a Microsoft Graph token.

# Impact

Credentials-only access to directory data, calendars, and unified search across Microsoft 365 mail, chat and files

# Status

Reported to MSRC 21 May 2025, recognised as Important 17 Oct 2025, fixed

cat ./details.txt

Presentations

21 talks on stage. Slides on request.

Our engineers present their research at CyberCon, BSides Canberra and other Australian security conferences. Browse the timeline and request any deck.

View the timeline

Engineering Blogs

Latest from the team

Explore our latest findings and deep-dives into security technologies.

10 Nov 2026

VULN-154544 Technical Advisory: Conditional Access Bypass and Scope-Independent Microsoft Graph Authorisation for First-Party Public Clients

VULN-154544 technical advisory: how a password-only ROPC request passed an Entra ID All resources policy, with token anatomy, a 15-client Graph matrix and KQL.

VulnerabilityConditional Access

22 Oct 2026

Exploiting the Microsoft 365 Substrate: How First-Party OAuth Clients Became an MFA Bypass (VULN-154544)

VULN-154544: how a Conditional Access resource exclusion let a stolen password reach Microsoft 365 data across the tenant through first-party OAuth clients, with root cause, detection, and the fourteen-month MSRC disclosure.

VulnerabilityConditional Access

6 July 2026

Passkeys Technical Deep Dive: WebAuthn Assertions, Ceremonies and Attestation

For engineers: the WebAuthn assertion field by field, the BE and BS flags, why synced passkeys can't be attested, discoverable credentials and the hybrid QR flow.

PasskeysWebAuthn

View All Posts

Ready to modernise your identity platform? Pick your path.

Whether you need strategic guidance, a platform assessment, or engineers on the ground, we’ll match the engagement to your need.

Assess your environment

Entra ID configuration review, Conditional Access audit, or identity architecture assessment. Know exactly where you stand.

Explore assessments

Design your target state

Target architecture for Entra ID, IGA, CIAM, or SSO migration. A clear blueprint before a single change is made.

Architecture advisory

Build with our engineers

Entra ID hardening, SSO application migration, MIM replacement, or Azure B2C to Entra External ID. We deliver the platform.

Explore engineering