Microsoft Entra ID account enumeration via unknown OAuth client ID

Threat actors may use unknown or non-existent OAuth client IDs in Microsoft Entra ID authentication requests to perform account enumeration, validate credentials, or evade application-based detection controls.

In this technique, the authentication request specifies an OAuth client ID that does not correspond to an application registration or service principal in the target tenant. As a result, application metadata—such as the application name, owner, or expected sign-in behavior—may be unavailable. This can reduce the effectiveness of detections that rely primarily on known application identifiers, successful sign-ins, or application-specific activity.

An authentication attempt involving an unknown OAuth client ID may indicate identity reconnaissance, credential validation, or an attempt to bypass application-centric monitoring. However, unknown client IDs can also result from application misconfiguration, obsolete clients, or requests directed to the wrong tenant.

The activity should be investigated when it is accompanied by suspicious authentication error codes, repeated attempts against multiple accounts, missing application metadata, unusual source locations or IP addresses, or other indicators of credential-testing activity. The combination of these signals may provide a high-confidence indication of malicious authentication activity.

NOTE: This threat rule includes a built-in lookback parameter set to 25 hours. Only events that occurred within this timeframe are processed by the rule.