Skip to main content
Modern 42
Contact Us
Vulnerability Disclosure

Entra ID & Intune vulnerabilities disclosed.

Vulnerabilities identified by the Modern 42 Labs security research team. We specialise in enterprise IAM and PAM systems, uncovering vulnerabilities within the tools we implement daily.

Report a vulnerabilityRead the advisories
Advisory 01, Intune

VULN-172966Intune MAM App Protection Conditional Access Bypass

A self-attested Intune MAM enrolment satisfies the 'require app protection policy' Conditional Access grant, letting the holder of a user's refresh token reach app-protected data without a genuine managed device or app.

Impact

Post-authentication access to the Office 365 mail, files and chat an app protection policy was meant to gate.

Read the VULN-172966 write-up
VULN-172966Fixed
MSRC severity
Moderate
Vendor
Microsoft
CVE
None assigned
Product
Intune MAM / Entra ID Conditional Access
Class
Conditional Access policy bypass / insufficient client and device attestation
CWE
CWE-287, CWE-290, CWE-345
Reported
Fixed

How the bypass works

  1. 01

    A stolen refresh token

    One valid token for the user, from adversary-in-the-middle or device-code phishing, an infostealer, or an insider's proxy.

  2. 02

    Register a device

    The token is enough to register a personal device. No managed handset is involved.

  3. 03

    Self-attested MAM enrolment

    The app instance, its device metadata and its compliance verdict all come from the client.

  4. 04

    Require app protection policy

    Satisfied

    The grant sees an enrolment ID and a protapp claim, and trusts them.

  5. 05

    Mail, files and chat

    The Office 365 data the app protection policy was meant to gate.

Advisory 02, Entra ID

VULN-154544Entra ID Conditional Access MFA Bypass via First-Party OAuth Clients

A Conditional Access policy targeting All resources with any single app exclusion let a stolen username and password bypass the policy's MFA and device compliance requirements and acquire a Microsoft Graph token. Authorisation on the Microsoft 365 substrate did not follow the token scope, so the same token reached directory data, calendar, mailbox and unified search depending on which first-party client was presented.

Impact

Credentials-only bypass of MFA and device compliance, enabling directory reconnaissance, internal calendar phishing, and data exfiltration across Microsoft 365 and connected sources.

Read the VULN-154544 write-up
VULN-154544Fixed
MSRC severity
Important (initially rated Moderate)
Vendor
Microsoft
CVE
None assigned
Product
Entra ID Conditional Access
Class
Conditional Access policy bypass / authorisation decoupled from token scope
CWE
CWE-287, CWE-285, CWE-863
Reported
Fixed

How the bypass works

  1. 01

    A username and password

    Credentials only. No second factor and no managed device.

  2. 02

    All resources policy, one app excluded

    Bypassed

    The policy required MFA and a compliant device, but a single unrelated app exclusion opened the gap.

  3. 03

    A Microsoft Graph token

    Issued with no MFA and no compliant device. It looked low privilege: a scope of just openid.

  4. 04

    Presented as a first-party client

    Authorisation on the Microsoft 365 substrate followed the client, not the token's scopes.

  5. 05

    Directory, calendar, mail and search

    Reached depending on which first-party client was presented.

Explore

Want to explore more work?

FAQ

Questions about these disclosures.

What is VULN-154544?
VULN-154544 is an Entra ID Conditional Access MFA bypass that M42 Labs reported to the Microsoft Security Response Centre on 21 May 2025. A Conditional Access policy targeting All resources with a single app exclusion let a stolen username and password acquire a Microsoft Graph token without MFA or a compliant device, and first-party OAuth clients then reached directory data, calendars, mailboxes and unified search with it.
What is VULN-172966?
VULN-172966 is an Intune MAM Conditional Access bypass that M42 Labs reported to the Microsoft Security Response Centre on 3 February 2026. A self-attested Intune MAM enrolment satisfied the 'require app protection policy' grant, so the holder of a user's refresh token could reach app-protected mail, files and chat without a genuine managed device or app.
Are these vulnerabilities fixed?
Yes. Microsoft rolled out the VULN-154544 fix (MC1223829) in phases from March to June 2026, and MSRC closed VULN-172966 as fixed on 25 June 2026. Both were fixed service-side.
Do VULN-154544 and VULN-172966 have CVE IDs?
No. VULN numbers are the tracking IDs the Microsoft Security Response Centre assigned. Both issues were remediated service-side, so there was no customer-patchable artefact to enumerate, and for VULN-154544 Microsoft declined a CVE citing the Moderate rating it later reversed.
How severe were they?
MSRC rated VULN-172966 Moderate. VULN-154544 was first rated Moderate and described as by design, then reclassified as Important (Elevation of Privilege) in October 2025.
Do I need to do anything in my tenant?
There is nothing to patch. The patterns behind both issues are still common, so audit All resources policies for app exclusions, keep a baseline MFA policy with no resource exclusions, require compliant devices rather than app protection alone for sensitive data, and monitor device registrations.
Who found them?
Rawson Wade of Modern 42 Labs researched and reported both. The initial VULN-154544 behaviour was surfaced by Michael Bruce.
How do I report a vulnerability to Modern 42?
If you believe you have discovered a security vulnerability in one of our systems, or want to collaborate on security research, contact us through the Modern 42 contact page.

Want us to have a look at something?

If you believe you’ve discovered a security vulnerability in one of our systems or want to collaborate on security research, please reach out to us.

  • Report a vulnerability in one of our systems
  • Collaborate on identity security research
  • Pressure-test your Conditional Access policies

Talk to M42 Labs

Security research and disclosure

Tell us what you have found, or what you want tested, and we’ll get back to you to talk it through.

Contact M42 LabsEmail us

We use cookies

We use cookies and similar technologies to help personalise content, measure the performance of our site, and provide a better experience. By clicking Accept, you consent to the use of all cookies.
Learn more.