A security engineer is investigating a Microsoft Entra ID sign-in log and notices a user has a 'Token issuer anomaly' risk detection. What does this detection indicate?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — c is correct because the 'Token issuer anomaly' detection in Microsoft Entra ID Protection specifically indicates that the Primary Refresh Token (PRT) used to obtain tokens appears anomalous, which can indicate a device that issued the PRT is not properly registered or the PRT has been manipulated, consistent with PRT theft or forgery attacks. A is incorrect because refresh token replay from different IPs would trigger 'Unfamiliar sign-in properties' or similar detections.
Full explanation below image
Full Explanation
C is correct because the 'Token issuer anomaly' detection in Microsoft Entra ID Protection specifically indicates that the Primary Refresh Token (PRT) used to obtain tokens appears anomalous, which can indicate a device that issued the PRT is not properly registered or the PRT has been manipulated, consistent with PRT theft or forgery attacks. A is incorrect because refresh token replay from different IPs would trigger 'Unfamiliar sign-in properties' or similar detections. B is incorrect because unexpected identity provider issues are handled through federation trust configuration errors. D is incorrect because SAML federation issues are different from this specific detection type.