LoFP LoFP / a legitimate application that has been deleted from the tenant while a client continues to authenticate against its former client id via ropc can generate error code 700016. a misconfigured legacy client submitting an incorrect client id is also possible. in both cases the client id is typically stable and low-volume, unlike the many distinct or randomized identifiers seen in spoofing. verify the application identifier, the source infrastructure, and whether the same principal is targeted by many different unresolved client ids.

Techniques

Sample rules

Entra ID ROPC Authentication with Unknown Client ID

Description

Identifies potential OAuth client ID spoofing in Microsoft Entra ID sign-in logs. Adversaries submit fabricated or non-existent application identifiers (client IDs) in Resource Owner Password Credentials (ROPC) authentication requests to the token endpoint. Because Entra ID validates the submitted credential before rejecting the request on application resolution, the resulting error code acts as a credential- and account-validity oracle while never producing a successful sign-in. By fragmenting attempts across many fictional application identifiers, adversaries evade per-application detections, rate limiting, and application-scoped Conditional Access. This rule detects a ROPC authentication that fails with error code 700016 (application not found in the directory) where no application display name resolves, which is characteristic of a spoofed client ID used for stealthy user enumeration and password spraying.

Detection logic

data_stream.dataset: "azure.signinlogs"
    and event.category: "authentication"
    and azure.signinlogs.properties.authentication_protocol: "ropc"
    and azure.signinlogs.properties.status.error_code: 700016
    and not azure.signinlogs.properties.app_display_name: *