Audit-Logs
- Azure Sign-In Log Bypasses: When 'Check the Logs' Isn't Enough
TrustedSec has now found four Azure Entra ID sign-in log bypasses since 2023. The latest two returned fully functioning tokens without any log entry. All are patched -- but organisations that relied on sign-in logs for detection need to reassess what they might have missed. Here's the pattern, the detection opportunity, and what to do.