# Conditional Access Misconfigurations Exposed 55 Orgs with MFA On

Attackers abused unblocked OAuth flows (device code, ROPC) against Microsoft 365 tenants, bypassing Conditional Access MFA to compromise 78 accounts across 64 orgs.

- Payout: Real-world hack
- Severity: high
- Program: Microsoft
- Analysis by: Huntress
- Disclosed: 2026-07-09
- Write-up quality: 6/10
- Original: https://www.huntress.com/blog/conditional-access-misconfigurations
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-conditional-access-misconfigurations
- Tags: area:cloud domain:cloud impact:ato impact:data-leak kind:incident platform:threat-intel sev:high tech:azure tech:oauth technique:legacy-endpoint technique:recon vuln:auth-bypass vuln:mfa-bypass

**Target:** Microsoft 365 / Entra ID OAuth token endpoint and Azure CLI
**Root cause:** Conditional Access policies scoped narrowly (specific apps, user groups, trusted locations, or report-only) never covered legacy OAuth flows like device code and ROPC, so tokens were minted without enforced MFA.
**Steps:**
1. Attacker generates a Microsoft device code and embeds it in a phishing lure (construction RFP themes) hosted on Railway PaaS IPs.
2. Victim authenticates and completes MFA; attacker collects the resulting OAuth token valid up to 90 days.
3. For ROPC: attacker replays validated username/password directly to the `/token` endpoint via Azure CLI, bypassing the authorization endpoint and MFA prompt.
4. Attacker scales attempts from an IPv6 range (LSHIY LLC), yielding 78 compromised accounts across 64 organizations.
**How found:** SOC detected anomalous M365 login surges: first from three Railway IPs (84% of traffic), later 81M attempts from an LSHIY-controlled IPv6 range; reviewing compromised accounts revealed 55 of 78 had active Conditional Access policies requiring MFA that didn't cover the abused flows.
**Exploitation:** Device code phishing harvested OAuth tokens from victims who completed MFA themselves, using clean Railway IPs to evade Identity Protection risk scoring; separately, ROPC credential replay against Azure CLI minted tokens without MFA because Conditional Access omitted Azure CLI/legacy auth from scope.
**Escalation:** Token reuse for up to 90 days grants persistent access; ROPC scaled to 81 million login attempts across tenants.
**Insight:** Audit Conditional Access for scope gaps: policies scoped to specific apps/groups/locations or left in report-only silently exclude legacy auth (ROPC) and device code flow; check whether 'All Cloud Apps' and all client app types are actually covered, and verify policies named 'Block X' truly block X.