Everyone says their environment is “Zero Trust.”
However, a single token from a hybrid-joined device can still allow silent lateral movement without triggering any obvious alert.
In many hybrid Microsoft Entra ID environments, lateral movement remains possible because of legacy synchronization, stale devices, incomplete Conditional Access coverage, and overprivileged identities.
As a result, the attack surface has changed, but it has not disappeared.
Modern identity attacks rarely begin with a domain admin password. Instead, they often begin with a valid session, a forgotten device, an overprivileged service principal, or a token that receives too much trust.

Primary Refresh Tokens

A Primary Refresh Token (PRT) appears when a user signs in to a Windows device that the tenant trusts, such as a Microsoft Entra joined, hybrid-joined, or compliant device.
Its purpose is legitimate: it gives users seamless single sign-on to Microsoft cloud resources without forcing them to re-authenticate every time.
However, that same convenience makes it valuable to attackers.
Windows protects the PRT and ties it to the user session and device context. Nevertheless, if an attacker gains local administrative or SYSTEM-level access to a compromised endpoint, token theft techniques may allow them to abuse the PRT and its associated session material.
Once an attacker has access to a valid PRT and the required session key, they may be able to:

• Request new access tokens through OAuth flows.
• Access services such as Microsoft Graph, Exchange Online, Teams, or SharePoint.
• Maintain access through token refreshes without repeatedly entering a password.
• Avoid some interactive authentication prompts because MFA was already satisfied during the original session.

This is not traditional credential theft.
No password needs to be typed.
No phishing page needs to capture a new MFA code.
Instead, the attacker abuses an already trusted session.
Therefore, PRT abuse can be difficult to detect. It may not appear as a suspicious password-based sign-in. In many cases, it can look like legitimate access from a trusted device or an existing session.
If teams do not monitor and constrain the PRT lifecycle, lateral movement remains possible even in environments that look mature on paper.

Overprivileged Service Principals

Service principals are another common blind spot.
In many tenants, teams create them for integrations, scripts, deployment pipelines, reporting jobs, or automation tools. However, after deployment, these identities often run for years without regular permission reviews.
Common issues include:

• Excessive API permissions such as Directory.ReadWrite.All or RoleManagement.ReadWrite.Directory.
• Application owners with the ability to assign elevated permissions.
• Missing reviews of AppRoleAssignments.
• Expired or unused credentials that are never removed.
• Certificates and secrets stored in automation systems without proper rotation.

As a result, identities created for operational reasons can quietly become privileged attack paths.
Once attackers compromise them, these identities can provide a quiet and long-term path into the tenant.
Depending on the permissions granted, an attacker may be able to create users, assign roles, modify applications, grant consent, or maintain access with minimal noise.
In practice, teams often treat service principals as infrastructure.
Attackers, however, treat them as identities.
And identities need governance.

Forgotten Devices, Valid Tokens

Devices often remain trusted long after they should.
For example, an organization may replace a laptop, abandon a virtual machine, or decommission a hybrid-joined device without removing the related objects from Active Directory and Microsoft Entra ID.
In some cases, a user leaves the company while the device object remains active.
As a result, stale devices can continue to act as trusted access paths.
Common causes include:

• No automatic device cleanup in Microsoft Entra ID or Intune.
• Hybrid-joined machines left behind after decommissioning.
• Weak compliance policies.
• Conditional Access policies that treat “joined” as equivalent to “trusted.”
• Missing ownership, health, or lifecycle validation.

This is where many Conditional Access designs fail.
A device should not earn trust only because it exists in the directory. Instead, trust should depend on compliance, ownership, health, management state, and active lifecycle.
Therefore, if Conditional Access treats every Microsoft Entra joined or hybrid-joined device as safe, attackers may abuse sessions from unmanaged, stale, or compromised machines.

A CVE Still Relevant in 2025

CVE-2022-26923 exposed a weakness involving certificate-based authentication and computer account behavior in Active Directory Certificate Services environments.
The vulnerability is not new. However, the underlying risk still matters.
Hybrid environments often depend on Active Directory, AD CS, synchronization, and Microsoft Entra ID working together. Consequently, when certificate services remain misconfigured or only partially remediated, compromise of on-premises identity infrastructure can still become cloud compromise.
A possible chain may look like this:

• The attacker compromises or abuses an on-premises Active Directory object.
• Certificate enrollment or mapping weaknesses are used to escalate privileges.
• The attacker gains control over synchronized identities or privileged objects.
• Changes are synchronized to Microsoft Entra ID through hybrid identity components.
• Cloud access is obtained without attacking the cloud directly.

This is why hybrid identity remains one of the most sensitive parts of a Microsoft environment.
Microsoft Entra ID may act as the control plane.
However, Active Directory often remains the foundation.
If attackers compromise the foundation, the cloud is not isolated from the impact.

What Is Getting Harder

Some forms of lateral movement are becoming harder.
Many tenants now block basic authentication, and legacy authentication is gradually disappearing. Browser token extraction has also become more difficult because of stronger session isolation, endpoint protection, and browser security improvements.
Credential reuse is easier to detect when teams enable, normalize, and monitor logs.
However, “harder” does not mean “impossible.”
Attackers adapt.
As passwords become harder to steal, they target tokens.
When MFA protects users, they target sessions.
If administrators lock down interactive access, attackers move toward service principals, automation accounts, and device trust.
In other words, the attack path changes, but the objective remains the same.

How Conditional Access Should Be Configured to Reduce PRT Abuse

To reduce exposure to Primary Refresh Token abuse, Conditional Access must focus on three areas:

• Device trust.
• Session lifetime.
• Token replay resistance.

Require Compliant or Hybrid-Joined Devices

Require access only from devices that Intune marks as compliant or that the organization properly manages as hybrid-joined.
Device trust should never depend only on the presence of a device object in Microsoft Entra ID.
Instead, teams should evaluate compliance state, ownership, health, management status, and lifecycle.

Block Legacy Authentication

Disable legacy protocols such as SMTP, POP3, IMAP, and other basic authentication methods.
These protocols do not support modern authentication controls. As a result, they can bypass many protections provided by Conditional Access.

Trigger MFA on Risky Sessions

Require MFA for sign-ins marked as medium or high risk by Microsoft Entra ID Protection.
Risk-based access decisions help detect abnormal behavior without forcing unnecessary friction on every user session.

Apply Conditional Access to All Cloud Apps

Do not limit Conditional Access policies only to visible user-facing applications.
Critical services such as Microsoft Graph, Exchange Online PowerShell, and administrative APIs also need coverage.
Attackers often prefer APIs because they are quieter, faster, and easier to automate.

Re-Authenticate for Privileged Access

Require step-up authentication for privileged roles such as Global Administrator, Privileged Role Administrator, and other sensitive administrative roles.
Administrative portals, role assignments, and privileged actions should always require stronger assurance.

Enable Token Protection Where Available

Where supported, enable token protection to bind tokens to the device.
Device-bound tokens make replay from another machine significantly harder.
However, token protection should not replace Conditional Access, device compliance, or monitoring.
It adds another layer of defense and reduces the value of stolen tokens.

Detection Opportunities

Even when attackers avoid passwords and malware, lateral movement often leaves subtle identity signals behind.
Monitor for:

• PRT renewals from unusual devices, locations, or network ranges.
• Unexpected Microsoft Graph activity performed by users or service principals.
• New AppRoleAssignments.
• Directory role changes.
• Consent grants to suspicious applications.
• Sign-ins from stale, non-compliant, or recently re-enabled devices.
• Resource-Based Constrained Delegation changes.
• Certificate enrollments from unusual systems or accounts.
• Unexpected modifications to device objects.
• Privileged operations performed through automation identities.

Zero Trust is not only about prevention.
It is also about detecting abnormal identity behavior before privilege becomes persistence.

Final Thought

A diagram may show a clean, modern Zero Trust architecture.
Everything segmented. Policies enforced. Logs centralized.
However, most real-world tenants do not operate like that. Not consistently.
In many cases, the problem is not the absence of controls. Instead, it is the false sense of coverage.
Lateral movement in Microsoft Entra ID does not need a new exploit.
It needs one stale token, one forgotten device, one misconfigured certificate template, or one overprivileged identity.
Therefore, security today is not about being perfect.
It is about knowing what is still exposed and closing the gaps before attackers find them.