What should I check after an EvilToken account compromise?

Treat the new device registrations as suspicious until you can explain them. Entra-joined but not Intune-managed describes their management status, not what access they had. Review sign-in and audit records around the event, including device registration, token issuance, application consent, and file activity. Check the affected user’s OneDrive and SharePoint audit events as well as relevant Graph activity, and preserve the logs before retention windows remove them.

Revoking sessions and resetting credentials are sensible containment steps, but also review existing app grants and authentication methods. If the records don’t clearly establish what happened, involve your incident-response team or Microsoft support rather than assuming the devices were only used to obtain a token.

I wouldn’t infer file access from the device entries alone. They’re a lead to investigate, not proof that OneDrive or SharePoint was accessed. Correlate the timestamps and identities across sign-in logs, audit logs, device records, and any available Graph or application telemetry. Look for activity under the compromised user and any newly created or authorized apps.

Also check whether the account was used for other purposes, such as registering external services or sending messages. A lack of obvious file events is useful, but it doesn’t by itself establish that no data was accessed.