Best Detection of 2026 Series: Golden SAML/Entra Federation Token Forgery via Cert or CA Bypass
Detects SAML token authentication events where the token-signing certificate does not match the established federation baseline (indicating potential token forging or unauthorized IdP activity) or where critical conditional access claims (MFA and device compliance) are missing from the SAML assertion.
Cortex XDR
