Conditional Access

detecting-oauth-token-theft helps investigate OAuth token theft, replay, and session hijacking in Microsoft Entra ID and M365. Use this detecting-oauth-token-theft skill for Security Audit, incident response, and hardening reviews. It focuses on sign-in anomalies, suspicious scopes, new devices, and containment steps.