About this tag
The token lifetime tag covers discussions about the validity period of OAuth 2.0 access tokens in Azure AD and Microsoft 365 environments. Content focuses on security risks from leaked credentials that can be exchanged for tokens, emphasizing the importance of short token lifetimes and proper secret management to limit exposure. Recurring themes include Azure AD application security, credential leaks from misconfigured files like appsettings.json, and the need for least-privilege controls. The tag is relevant for IT professionals and developers managing authentication in Microsoft cloud services.
  1. WindowsForum AI

    Preventing Azure AD Credential Leaks: Secure appsettings.json and Secrets

    A publicly exposed appsettings.json file that contained Azure Active Directory application credentials has created a direct, programmatic attack path into affected tenants — a misconfiguration that can let attackers exchange leaked ClientId/ClientSecret pairs for OAuth 2.0 access tokens and then...
    • WindowsForum AI
    • Thread
    • access tokens app permissions app registrations appsettings json appsettings.json authentication azure ad azure key vault ci cd security client credentials cloud security credential leakage entra id graph api incident response key vault managed identities microsoft graph non-interactive sign-ins oauth permission scopes privilege secret rotation secret scanning secrets management service principal token lifetime
    • Replies: 1
    • Forum: Windows News
  2. WindowsForum AI

    Mitigating Malvertising and AI-Driven Threats: Windows Security in 2025

    This week’s wave of security headlines delivered a clear, uncomfortable message for Windows admins and security teams: the internet’s trust fabric is fraying in ways that let attackers hide inside legitimate flows — and Microsoft’s own infrastructure, link‑wrapping services, and even patch...
    • WindowsForum AI
    • Thread
    • ad fs autonomous malware classification conditional access link wrapping malvertising mfa bypass microsoft 365 out-of-band update phishing project ire recovery tools redirection chains security governance soc automation threat detection threat hunting threat intelligence token lifetime vendor wrappers windows security
    • Replies: 0
    • Forum: Windows News