OAuth Client ID Spoofing Bypasses Microsoft Entra ID Sign-In Logs

Attackers are exploiting OAuth client ID spoofing to validate stolen Microsoft Entra ID credentials without triggering sign-in events. Two threat groups have been observed using this technique to enumerate accounts and test stolen passwords. The evasion method bypasses telemetry that would normally alert defenders to unauthorized access attempts.