The Golden Key of Modern Microsoft Cloud Identity

In hybrid enterprise environments, Microsoft Entra ID (formerly Azure Active Directory) serves as the primary identity provider for Microsoft 365, Azure subscriptions, and third-party SaaS single sign-on (SSO).

To deliver a seamless user experience, Windows 10 and 11 workstations joined to Entra ID or Hybrid Azure AD utilize a Primary Refresh Token (PRT). Issued by the CloudAP authentication provider, the PRT is a cryptographically signed JSON Web Token (JWT) that allows employees to access cloud resources without constantly re-entering passwords or satisfying MFA prompts.

For an offensive operator or advanced threat actor, obtaining the PRT is equivalent to acquiring the modern cloud equivalent of a Kerberos Golden Ticket.

---

The Architecture of the Primary Refresh Token

When a Windows machine registers with Entra ID:

1. Device Key Pair Generation: A transport key pair is generated and sealed within the machine's Trusted Platform Module (TPM).


2. PRT Issuance: During initial authentication, Entra ID issues the PRT along with an encrypted Session Key.


3. Cryptographic Proof-of-Possession: Whenever a client application (such as Outlook, Teams, or Edge) requests access to an Azure resource, it does not send the raw PRT. Instead, it signs a challenge nonce using the session key, generating a header known as x-ms-RefreshTokenCredential.

Client Application (Edge / Teams)
       │
       ▼ Requests access token for exchange.office.com
CloudAP Plugin (lsass.exe)
       │
       ├─► Retrieves PRT from memory
       ├─► Signs request nonce with Session Key
       ▼
Entra ID Token Endpoint (login.microsoftonline.com)
       │
       ├─► Validates signature against Session Key
       ├─► Confirms Device Identity and Compliance State
       ▼
Access Token Issued (Valid for 60-90 minutes)

---

Extracting the PRT: Pass-the-PRT Mechanics

If an attacker secures administrative privileges on a compromised Windows endpoint (via phishing, software exploitation, or local privilege escalation), they can access the Local Security Authority Subsystem Service (lsass.exe).

While the private device keys are secured inside the TPM chip, the Session Key used to generate cryptographic proofs must be temporarily accessible to LSASS to handle high-frequency authentication requests.

Tooling: Dumping the Session Key

Using offensive security frameworks such as AADInternals or custom C++ memory extractors, an operator interacts directly with the CloudAP plugin:

# Extract PRT and Session Key from LSASS memory context
Import-Module .\AADInternals.ps1
$PRTDetails = Get-AADIntUserPRTToken
Output extracted cryptographic material
$PRTDetails.PRT
$PRTDetails.SessionKey

Replaying Proofs Across Untrusted Infrastructure

Once the adversary holds the PRT and the associated Session Key:

1. They launch an arbitrary browser on an external, attacker-controlled machine.
2. They inject an HTTP proxy (e.g. mitmproxy or Burp Suite) that intercepts requests to login.microsoftonline.com.
3. The proxy appends the generated x-ms-RefreshTokenCredential cookie containing the valid cryptographic signature.

GET /common/oauth2/v2.0/authorize?client_id=... HTTP/1.1
Host: login.microsoftonline.com
Cookie: x-ms-RefreshTokenCredential=eyJhbGciOiJSU0EyNTYi...;
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)

Entra ID validates the signature, confirms that the request originates from a registered device ID, and grants full access to corporate email, SharePoint data, and Azure subscription management portals.

---

Bypassing Conditional Access Policies

Security architects frequently rely on Conditional Access policies configured to require:

• "Require device to be marked as compliant"


• "Require Hybrid Azure AD joined device"

Because the PRT contains claims certifying the originating device's registration ID (deviceid), replaying the PRT successfully bypasses device-compliance requirements, even when the attacker is operating from an entirely unauthorized, unmanaged Linux laptop.

---

Mitigation and Defense Blueprint

Protecting enterprise cloud identity against Pass-the-PRT attacks requires structural defenses:

1. Enable Windows Defender Credential Guard: Credential Guard isolates LSASS secrets inside a hardware-isolated Virtualization-Based Security (VBS) enclave, preventing direct memory access even by local SYSTEM accounts.


2. Implement Continuous Access Evaluation (CAE): CAE allows Entra ID to revoke active sessions in near real-time when IP address anomalies or user risk status changes occur.


3. Strict Token Protection for Conditional Access: Mandate Token Binding (Strict Token Protection), binding refresh tokens cryptographically to the device's hardware TPM, making it computationally impossible to export session keys to external endpoints.