Device code sign-in followed by non-interactive token replay from new IP

Arnold Chan@slaz

•updated 4 days ago•0•0•1

Detects a successful device-code sign-in followed within 60 minutes by non-interactive replay from a different IP AND a persistence action (inbox rule, app consent, device add) from a non-original IP. Persistence is now mandatory (inner join) instead of optional, and the retired AADSignInEventsBeta table is replaced by EntraIdSignInEvents.