PRT Theft: Device Requesting Tokens for Multiple Distinct Users
Detects a single device requesting Entra ID access/refresh tokens on behalf of multiple distinct users in a short window, indicative of Primary Refresh Token (PRT) theft used to impersonate other users, as CISA's red team did against an application owner.
Microsoft Sentinel (KQL)
