4 million fake applications and one blind spot: A SOC playbook for OAuth client ID spoofing
Brief
Key takeaways
- OAuth client ID spoofing defeats detections that key off application name or a known application ID, because the field itself is fabricated, rotated or blank.
- AADSTS700016 paired with an unrecognized client ID can mean valid credentials, not a broken app registration — treat it as a triage signal, not noise.
- Effective detection logic correlates client ID cardinality, missing application names and AADSTS error sequences across a time window, not any single event.
- A rehearsed response runbook (reset, revoke, review) matters as much as the detection query itself, and the cost of skipping it shows up as account takeover, not just alert fatigue.
The signal hiding in plain sight
Picture a queue of failed sign-in alerts against Microsoft Entra ID. Each one points to a different application ID. None of the IDs are registered in the tenant.