Device Registration Abuse

Register an attacker-controlled device or MFA factor to a compromised account in an identity or device-management provider, then use that association to satisfy MFA or device-based access checks and maintain access. This entry's concrete procedure is Microsoft Entra device registration with AADInternals. Registration alone does not grant privileges, guarantee Intune compliance, or prove that a PRT with MFA claims was issued; downstream access depends on the tenant's authentication and Conditional Access policies.