Latest / The Digital Warfare Podcast
Digital Warfare Podcast Daily Brief May 06, 2026
Summary
A red team engagement demonstrated how Microsoft Entra ID Conditional Access could be bypassed through phantom device registration and Primary Refresh Token abuse. Researchers used the Device Registration Service endpoint to register a fake corporate device from Linux, obtain a signed Azure AD certificate, and mint a PRT containing forged device claims. Azure AD then treated the session as device-authenticated, bypassing policies requiring compliant or hybrid-joined devices. The research also exposed weaknesses in Intune compliance validation and hybrid identity privilege design.
Key…
The skinny
The skinny isn't ready yet — notes appear once the transcript is processed.