Why do failed token replays keep making users high risk in Entra?
After a phishing incident, we reset passwords and revoked sessions. There have been no successful malicious sign-ins since, but attempts using an apparently revoked token keep failing and…