Entra Sign-in MFA Satisfied via External Provider With No Genuine Challenge

Ibrahim Saud@tektrix

•updated 13 days ago•2•0•2

Detects Azure AD sign-in events where Multi-Factor Authentication (MFA) was reportedly satisfied by an External Authentication Method (EAM) claim without evidence of a traditional secondary authentication challenge. This behavior is indicative of a 'TrustSink' technique where a rogue or compromised OIDC provider injects a spoofed assertion of MFA success into the authentication token.