Does revoking a user’s sessions invalidate a PRT on an Entra-joined device?
We've seen device-code phishing attacks where an attacker uses an OAuth token to register a rogue device in Entra ID and obtain a Primary Refresh Token (PRT). Because…
Primary Refresh Token
Does revoking a user’s Entra sessions invalidate a PRT on a joined device?
We've been investigating device-code phishing attacks where an attacker authenticates through a device-code flow, obtains OAuth tokens, and then registers or joins a rogue device to Entra. The…