A security engineer is investigating a Microsoft Entra ID sign-in log and notices a user has a 'Token issuer anomaly' risk detection. What does this detection indicate?
Select an answer to reveal the explanation.
Short Explanation
Think SAML, not PRT. A token issuer anomaly means the SAML token came from a federated issuer that may be compromised, with claims that look off or match known attacker patterns. You're looking at trouble at the identity provider that signs the tokens, not a stolen device credential.
Full Explanation
Token issuer anomaly is a Microsoft Entra ID Protection sign-in risk detection that's calculated offline and requires Entra ID P2. It indicates that the SAML token issuer for the associated SAML token is potentially compromised, because the claims in the token are unusual or match known attacker patterns. That points to a federated identity provider issuing a suspicious SAML assertion, the pattern seen in forged-token attacks against federation servers. A stolen refresh token replayed from a new IP address fits the Anomalous token detection instead, which covers session and refresh tokens with odd lifetimes or unfamiliar locations. A JWT access token from an unexpected issuer isn't what this detection examines; it's specifically about the SAML token and its issuer. A forged or misused Primary Refresh Token is a different signal: Possible attempt to access Primary Refresh Token is a user risk detection fed by Microsoft Defender for Endpoint. Exam tip: tie token issuer anomaly to SAML and federation, anomalous token to replay, and PRT access to Defender for Endpoint. To check, open the risk detection in ID Protection, confirm the federated domain involved, then review the identity provider's token-signing certificates and recent sign-ins.