Conditional Access Bypass via Resource Exclusion

Exploitation of a Conditional Access policy enforcement gap where policies targeting 'all resources' with at least one resource exclusion allow low-privileged scopes (e.g., User.Read, openid) to be issued without triggering the policy. Certain Microsoft first-party public clients ignore token scopes, enabling enumeration and modification of Entra ID data despite limited scopes.