Family-Of-Client-Ids - FOCI

What is FOCI and Why It Matters: Azure uses FOCI to allow seamless token refreshes across Microsoft 365 apps (like Outlook, Teams, OneDrive) without repeatedly prompting the user to log in. It links multiple applications under a single refresh token family, enhancing usability—but this convenience introduces security risks.

Azure access tokens allow you to authenticate to certain endpoints as a user who signs in with a device code. If you are in possesion of a FOCI (Family of Client IDs) capable refresh token you can use it to get access tokens to all known FOCI capable endpoints. Since the refresh-token also contains the information if the user has done multi-factor authentication you can use this. Once you have a user's access token, it may be possible to access certain apps such as Outlook, SharePoint, OneDrive, MSTeams and more.

For instance, if you have a Graph or MSGraph refresh token, you can then connect to Azure and dump users, groups, etc. You could then, depending on conditional access policies, switch to an Azure Core Management token and run AzureHound. Then, get an Outlook access token and read/send emails or MS Teams and read/send teams messages!

For more on Azure token types Microsoft identity platform access tokens

Abusing this with TokenTactics

Invoke-RefreshToAzureCoreManagementToken
Invoke-RefreshToAzureKeyVaultToken
Invoke-RefreshToAzureManagementToken
Invoke-RefreshToAzureStorageToken
Invoke-RefreshToDeviceRegistrationToken
Invoke-RefreshToDODMSGraphToken
Invoke-RefreshToGraphToken
Invoke-RefreshToMAMToken
Invoke-RefreshToMSGraphToken
Invoke-RefreshToMSManageToken
Invoke-RefreshToMSTeamsToken
Invoke-RefreshToOfficeAppsToken
Invoke-RefreshToOfficeManagementToken
Invoke-RefreshToOneDriveToken
Invoke-RefreshToOutlookToken
Invoke-RefreshToSharePointToken
Invoke-RefreshToSubstrateToken
Invoke-RefreshToToken
Invoke-RefreshToYammerToken

GitHub - rvrsh3ll/TokenTactics: Azure JWT Token Manipulation ToolsetGitHub