Microsoft GraphActivity Logs

Invisible password sprays. Invisible logins. Full tokens returned. Nyxgeek here. It's 2026 and I've got two more Azure Entra ID sign-in log bypasses to share with you. Don't get too excited…these bypasses were recently fixed, but I think it's important that people know. By sending a specially crafted login attempt to the Azure authentication endpoint, it was possible to retrieve valid tokens without the activity appearing in the Entra ID sign-in logs.

Introduction Microsoft Graph is a unified REST API endpoint that allows you to query data from various sources, including data stored in Microsoft 365. Microsoft Graph provides access to a suite of services including Microsoft 365, Enterprise Mobility + Security, and Windows. In the wrong hands, access to Microsoft Graph API can be misused by threat actors to compromise users; for example, by reading emails or files on SharePoint.

&nbsp &nbsp monitoring, exchange, security, cloud computing, azure, microsoft 365&nbsp What are Microsoft Graph activity logs? Microsoft Graph activity logs are extensive chains of HTTP requests received and processed by MS Graph in a tenant. It captures: HTTP Requests: Details about the HTTP requests received and processed by Microsoft Graph. Timestamps: Time and date when each activity occurred, providing a chronological record of events.