• Adam Boylan
• David Cash
• 23 Jun, 2026
• • Disclosure
  • Vulnerability
  • Bypass

Microsoft Graph API - Hidden Exclusions with Overly Scoped Permissions

Hidden exclusions in Entra ID Conditional Access policies let attackers bypass MFA and use an overly scoped Graph token to enumerate tenant data.