Hunt for Expired Tokens Attempting to sign-in to Entra ID

Google SecOps@GoogleSecOps

•updated Apr 1, 2025•3•0•8

Identify Entra ID OAuth refresh tokens are attempted to be used but have expired. This could be because the token hasn't been used for 90 days or it has been revoked