---
id: 7673
title: "Bypassing Microsoft Entra Conditional Access Policies via Nested App Authentication"
source_domain: netspi.com
source_url: "https://www.netspi.com/blog/technical-blog/cloud-pentesting/bypassing-microsoft-entra-conditional-access-policies-via-nested-app-authentication/"
published_at: "2026-06-22T00:00:00Z"
tags: ["oauth", "conditional-access", "msrc", "bypass", "persistence", "microsoft-entra", "graph-api"]
phying_url: "https://phying.com/item/7673"
lang: en
---

# Bypassing Microsoft Entra Conditional Access Policies via Nested App Authentication

## Summary

NetSPI discovered Nested App Authentication (BroCI) flows that bypass Entra Conditional Access policies to mint Graph API tokens, mainly a post-phishing persistence vector; Microsoft has fixed it.

## Intelligence Metadata

- **Sources:** netspi.com
- **Published:** 2026-06-22T00:00:00Z
- **Original:** https://www.netspi.com/blog/technical-blog/cloud-pentesting/bypassing-microsoft-entra-conditional-access-policies-via-nested-app-authentication/
- **Phying News:** https://phying.com/item/7673