# microsoft graph Published articles for microsoft graph. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens DevFeed: [Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens]() Original publisher: [Read original article]() Author: The Hacker News Published: 2026-10-27T12:09:50Z Content type: news Language: en Sources: [Cyber Newsroom]() Topics: [Android Security](), [Android](), [Microsoft](), [Microsoft Teams](), [android-permissions]() Tags: [android](), [attack](), [authentication](), [broker](), [calendar](), [catalog](), [cisa](), [cve](), [email](), [exploitation](), [exploited](), [files](), [identity-security](), [malicious](), [microsoft](), [microsoft-authenticator](), [microsoft-graph](), [mobile-security](), [permissions](), [teams](), [tokens](), [vulnerability](), [work]() ### AI overview Microsoft fixed CVE-2026-80097 in Authenticator for Android 6.2606.4246. A permissionless malicious app could launch the exposed AccountChooserActivity, claim to be a trusted Microsoft app such as Teams, and obtain work-account tokens; the signature check verified the installed app's signature but did not verify which app had actually made the request. Enclave's tests found tokens could permit access to email, files, and calendars. Enclave reported no user interaction beyond having a signed-in account, while Microsoft says exploitation requires the user to complete an authentication flow. Microsoft reports no exploitation in attacks. Update to version 6.2606.4246 or later; organizations can enforce that minimum through device management. The sources do not establish whether updating revokes tokens already obtained. ### Source excerpt Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens Microsoft has fixed a flaw in its Authenticator app for Android that let a malicious app with no permissions pose as a trusted Microsoft app, such as Teams, and collect sign-in tokens for a victim's w ... Read more Published Date: Oct 27, 2026 (3 hours, 58 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-80097 ## Incomparable Minima in Agent Tool Authorization DevFeed: [Incomparable Minima in Agent Tool Authorization]() Original publisher: [Read original article]() Author: Xin Xu Published: 2026-10-26T04:00:00Z Content type: article Language: en Sources: [arXiv: Cryptography and Security]() Topics: [Authorization](), [Agent Harness](), [AI Chat](), [Test-driven development]() Tags: [agent](), [api](), [authorization](), [benchmarks](), [cs-cr](), [deployments](), [frontier-models](), [google](), [graph](), [http](), [microsoft](), [microsoft-graph](), [models](), [permission](), [ranking](), [resource](), [risk](), [scale](), [score](), [services](), [tool]() ### AI overview Analyzing Microsoft and Google authorization tables, the study finds that "smallest sufficient grant" often has no unique answer: minimal grants are incomparable for 29.8-33.3% of generated Graph tasks and 3.2% of Google resource tasks. How privilege scales rate these grants depends substantially on the scale used: Microsoft's privilegeLevel calls 67.4-74.4% of incomparable pairs equal, while a reconstructed FORTIS ladder yields 90.7-98.7% on Google and 89.0-92.0% on Graph. Four risk measures sometimes rank grants in opposite directions, so there is no measure-independent ordering for those pairs. In 1,708 decisions, six frontier models chose a minimal grant 99.0% of the time, but one smallest under all four measures only 66.7% of the time; 22.1% of choices were matched or beaten on every measure by another option. The authors propose reporting which minimal grant an agent chose and showing approval reviewers the alternatives. ### Source excerpt arXiv:2610.31914v1 Announce Type: new Abstract: An agent that needs a tool needs authority to call it, and every proposal for governing that authority has to answer one question: of two grants that both let the agent finish a task, which one is smaller? Over-privilege benchmarks score agents against this answer, and permission solvers compute it. We check the question against the authorisation tables that Microsoft and Google publish, covering 22,305 Microsoft Graph endpoint bindings and 23,852 Google API methods, on tasks generated from each table's own resource structure. For 29.8-33.3% of Graph tasks and 3.2% of Google resource tasks the question has no answer, because the minimal sufficient grants form an antichain, a set of grants none of which authorises a subset of what another does. In its two main authorisation modes, Microsoft's shipped privilegeLevel rates 67.4-74.4% of these incomparable pairs equal. Google ships no such scale, so on Google we apply a reconstruction of the FORTIS privilege ladder, which rates 90.7-98.7% equal. Applying the same reconstruction to Graph attributes much of that difference to the scale rather than the corpus: its form based on the HTTP verb alone rates 92.0% of Google pairs and 89.0-92.0% of Graph pairs equal. Four risk measures (operations, writes, services reached, administrative surface) order 28.7% of incomparable Google pairs and 15.7-23.4% of Graph pairs in opposite directions, so for those pairs the ranking has no measure-independent answer. Offered pools of minimal and larger grants, 6 frontier models pick a minimal grant on 99.0% of 1,708 decisions, a grant smallest under all four measures on 66.7%, and on 22.1% a grant that another option matches or beats on every measure. We propose that benchmarks report which minimal grant an agent chose and that deployments show the alternatives to whoever approves the grant. ## Pre-authenticated (tempauth) URLs are retiring: move to Microsoft Entra ID tokens before April 1, 2027 DevFeed: [Pre-authenticated (tempauth) URLs are retiring: move to Microsoft Entra ID tokens before April 1, 2027]() Original publisher: [Read original article]() Author: SharePoint team Published: 2026-10-08T13:10:46Z Content type: article Language: en Sources: [Microsoft 365 Developer]() Topics: [Entra ID](), [Secure token management](), [Secrets Management](), [Single sign-on (SSO)]() Tags: [apis](), [developer](), [entra-id](), [microsoft-365-developer](), [microsoft-entra-id](), [microsoft-graph](), [sharepoint](), [tokens]() ### AI overview Starting April 1, 2027, affected Microsoft Graph file APIs will stop returning pre-authenticated URLs. Applications must use Microsoft Entra ID access tokens to access returned URLs. Developers should audit affected file operations, plan the appropriate Graph or SharePoint token flow, and validate changes in a test tenant. ### Source excerpt Starting April 1, 2027, affected Microsoft Graph file APIs will no longer return pre-authenticated URLs. Applications using these APIs must authenticate requests with Microsoft Entra ID access tokens. The post Pre-authenticated (tempauth) URLs are retiring: move to Microsoft Entra ID tokens before April 1, 2027 appeared first on Microsoft 365 Developer Blog. ## A Modern Guide to Using OAuth 2.0 with Node.js DevFeed: [A Modern Guide to Using OAuth 2.0 with Node.js]() Original publisher: [Read original article]() Author: Dean Hume Published: 2026-10-08T00:00:00Z Content type: tutorial Language: en Sources: [Dean Hume]() Topics: [OAuth 2.0](), [Deno](), [Visual Studio Code]() Tags: [azure](), [microsoft-graph](), [node-js](), [oauth]() ### AI overview A practical tutorial demonstrates obtaining an OAuth 2.0 access token in Node.js with MSAL and using built-in fetch to call Microsoft Graph. It covers client credentials, loading credentials from an environment file, and common permission-related 403 errors. ### Source excerpt Get an OAuth 2.0 access token in Node.js with MSAL, then call Microsoft Graph using built-in fetch and credentials loaded from an environment file. ## China-nexus UAT-11587 targets government and policy organizations across Asia with Antino backdoor DevFeed: [China-nexus UAT-11587 targets government and policy organizations across Asia with Antino backdoor]() Original publisher: [Read original article]() Author: Ashley Shen Published: 2026-09-30T10:00:01Z Content type: news Language: en Sources: [Cisco Talos Blog]() Topics: [Government Cybersecurity](), [CL-CRI-1131](), [LLM security](), [Distributed Systems & Parallel Computing]() Tags: [apt](), [backdoor](), [cisco-talos-dns-security](), [cisco-talos-email-threat-prevention](), [cisco-talos-malware-protection](), [cloudflare](), [microsoft-365](), [microsoft-graph](), [phishing](), [powershell](), [rust](), [security](), [threat-spotlight]() ### AI overview Cisco Talos reports that UAT-11587 targeted government and policy organizations across Asia with Antino, a previously undocumented Rust-compiled Windows backdoor. The malware supports reconnaissance, command execution, file transfer, shellcode loading and persistence, and uses Microsoft 365, including Outlook and OneDrive, for command and control. Talos says the campaign used spear-phishing and assesses with high confidence that the group is China-nexus. ### Source excerpt Cisco Talos uncovered a cluster of activity we track as UAT-11587 targeting government and policy organizations across Asia, including in Taiwan, India, the Philippines, and Cambodia, to deliver a previously undocumented backdoor referred to as "Antino" in developer artifacts. ## DavMail 7.0.0 puts most of its work into Microsoft Graph DevFeed: [DavMail 7.0.0 puts most of its work into Microsoft Graph]() Original publisher: [Read original article]() Author: Anamarija Pogorelec Published: 2026-09-22T03:48:17Z Content type: release Language: en Sources: [Help Net Security]() Topics: [API](), [gateway](), [Java](), [Microsoft](), [protocols](), [client](), [Back end](), [LDAP]() Tags: [api](), [backend](), [client](), [email](), [gateway](), [java](), [ldap](), [microsoft](), [microsoft-exchange](), [microsoft-graph](), [news](), [open-source](), [protocols](), [security](), [server](), [software]() ### AI overview DavMail 7.0.0 is a Java gateway that translates open mail, calendar, and contact protocols into Exchange and Office 365 requests. The release focuses on Microsoft Graph, adds folder delta sync, improves meeting and contact handling, preserves IMAP message metadata, and changes permissions and sign-in behavior. ### Source excerpt Anyone who wants to leave Outlook but still has a mailbox on Exchange needs a translator. DavMail is one: a Java gateway that converts the open protocols most mail, calendar and contact apps speak (IMAP, SMTP, CalDAV, CardDAV and LDAP) into requests Exchange and Office 365 accept. "Ever wanted to get rid of Outlook?" the project page asks. DavMail 7.0.0 removes the davmail.caldavImpersonate option, turns on a new sync method by default, requests an extra ... More -> The post DavMail 7.0.0 puts most of its work into Microsoft Graph appeared first on Help Net Security. ## GhostCode attackers abuse device codes to take over Microsoft 365 accounts DevFeed: [GhostCode attackers abuse device codes to take over Microsoft 365 accounts]() Original publisher: [Read original article]() Author: Shweta Sharma Published: 2026-09-18T15:16:22Z Content type: news Language: en Sources: [Computerworld]() Topics: [microsoft 365](), [OAuth 2.0](), [Social engineering](), [Authentication](), [Entra ID](), [MFA](), [API](), [Internet of things]() Tags: [access-control](), [access-control-authentication-cybercrime-identity-and-access-management-microsoft-microsoft-365](), [active-directory](), [auth](), [authentication](), [cybercrime](), [identity-and-access-management](), [microsoft](), [microsoft-365](), [microsoft-graph](), [oauth-2-0](), [phishing](), [security](), [social-engineering](), [tokens]() ### AI overview Computerworld reports that the GhostCode phishing kit abuses Microsoft's OAuth 2.0 device authorization flow to trick Microsoft 365 users into authenticating an attacker-controlled device. Stolen tokens are used to register devices, obtain credentials, and establish persistence in the victim's Microsoft environment. ### Source excerpt Microsoft 365 users are being tricked into handing over access to their accounts by a new phishing kit, GhostCode, that exploits a weakness in a legitimate device authorization flow. Researchers in eSentire's threat response unit identified the campaign in late August 2026. The kit abuses Microsoft's OAuth 2.0 device authorization grant flow, a legitimate mechanism designed to enable authentication from IoT devices, smart TVs, printers, or other devices that cannot easily support a conventional browser-based login. The technique, known as device-code phishing, has been seen in other attacks before. As part of the flow, the device displays a code for the user to enters in a browser on another device to complete authentication. GhostCode poses as one such device, gets Microsoft's OAuth to generate a device code and then convinces the victim to enter it on Microsoft's authentication page. The victim then signs in and completes multifactor authentication as normal -- but the authentication is for the attacker-controlled device, allowing them to obtain the resulting authentication tokens. These tokens are then used to register attacker-controlled devices, obtain additional credentials and establish persistence in the victim's Microsoft environment. In the campaign observed by eSentire, the attack involved a social-engineering setup where attackers pose as procurement officers through a web contact form before moving conversations to an NDA-themed HTML file. Opening the file took the victim to the device-code phishing page. Stolen tokens allow persistence GhostCode's post-authentication activity is focused on turning the stolen access into persistence inside the Microsoft environment. Once access was granted, eSentire recorded nine successful API calls over a 78-second period, involving Microsoft Intune Enrollment, the Device Registration Service, Azure Active Directory and Microsoft Graph. Three devices were registered during that time, at 28, 53 and 77 seconds after auth ## Investing in a more reliable Microsoft Graph PowerShell experience DevFeed: [Investing in a more reliable Microsoft Graph PowerShell experience]() Original publisher: [Read original article]() Author: Microsoft Graph team, Barry Gervin, Gavin Barron Published: 2026-09-16T16:02:40Z Content type: release Language: en Sources: [Microsoft 365 Developer]() Topics: [PowerShell](), [Windows](), [migration](), [.NET]() Tags: [microsoft](), [microsoft-365-developer](), [microsoft-graph](), [microsoft-graph-powershell](), [migration](), [powershell](), [release](), [version](), [windows]() ### AI overview Microsoft is moving active development and maintenance of Microsoft Graph PowerShell modules to PowerShell 7.x and later. Windows PowerShell 5.x compatibility will enter a 12-month retirement period, while v2.x modules will continue to work and receive required security fixes. A new v3 major version is planned for Q4 2026 and will support only PowerShell 7.x. ### Source excerpt We're focusing Microsoft Graph PowerShell on the platform where we can give you the most reliable, capable, and well-maintained experience: PowerShell 7.x and later. Built on modern .NET, PowerShell 7.x resolves many of the underlying assembly-loading and dependency issues that affect Windows PowerShell 5.x today. Concentrating our engineering there means faster fixes, quicker delivery of [...] The post Investing in a more reliable Microsoft Graph PowerShell experience appeared first on Microsoft 365 Developer Blog. ## Thunderbird Desktop New Protocol Support: Microsoft Graph API DevFeed: [Thunderbird Desktop New Protocol Support: Microsoft Graph API]() Original publisher: [Read original article]() Author: Eleanor Dicharry Published: 2026-09-02T19:58:47Z Content type: release Language: en Sources: [The Thunderbird Blog]() Topics: [API](), [Microsoft](), [microsoft 365](), [Protocol (disambiguation)](), [email]() Tags: [api](), [desktop](), [development](), [email](), [exchange](), [microsoft](), [microsoft-365](), [microsoft-graph](), [protocol](), [thunderbird]() ### AI overview Thunderbird Desktop announces native support for the Microsoft Graph API as Microsoft phases out Exchange Web Services for Microsoft 365 and Exchange Online. The article explains which Thunderbird users need to switch and which account configurations require no action. ### Source excerpt As many of you know, Microsoft will be disabling Exchange Web Services (EWS) support on its Microsoft 365 platform later this year. The Thunderbird Desktop team has been hard at work to ensure continuity of functionality through this transition, and today we are pleased to announce the release of native Thunderbird support for the Microsoft [...] The post Thunderbird Desktop New Protocol Support: Microsoft Graph API appeared first on The Thunderbird Blog. ## Thunderbird 153 "Meadow" is out now! DevFeed: [Thunderbird 153 "Meadow" is out now!]() Original publisher: [Read original article]() Author: Brian Offredi Published: 2026-07-22T21:45:41Z Content type: release Language: en Sources: [The Thunderbird Blog]() Topics: [email](), [OAuth](), [Microsoft](), [User Interfaces](), [notifications]() Tags: [announcements](), [authentication](), [bug](), [meadow-153](), [microsoft-exchange](), [microsoft-graph](), [notifications](), [release](), [releases](), [thunderbird]() ### AI overview Thunderbird 153 "Meadow" is an Extended Support Release featuring a redesigned Account Hub, native Microsoft Exchange support through Exchange Web Services, improved account and address-book setup, operating-system accent colors, native notification actions, OAuth authentication in the default browser, and numerous refinements and bug fixes. ### Source excerpt As we head into the summer months, a new Extended Support Release (ESR) is in full bloom. Thunderbird 153 "Meadow" is out now, and from all of us at MZLA, the Thunderbird Council, and our global community of contributors, we can't wait for you to try it out. "Meadow" builds on Thunderbird 140 "Eclipse," along [...] The post Thunderbird 153 "Meadow" is out now! appeared first on The Thunderbird Blog. ## How Data Graphs Built a True Hybrid Graph RAG Platform DevFeed: [How Data Graphs Built a True Hybrid Graph RAG Platform]() Original publisher: [Read original article]() Author: info@qdrant.tech (Andrey Vasnetsov) Published: 2026-04-22T00:00:00Z Content type: article Language: en Sources: [Qdrant Blog on Qdrant - Vector Search Engine]() Topics: [graph-database](), [Retrieval Augmented Generation (RAG)](), [Embeddings](), [Artificial Intelligence](), [AI Agent](), [workflow automation](), [data]() Tags: [ai](), [ai-agent](), [approximate-nearest-neighbor-search](), [bert](), [database](), [embeddings](), [fasttext](), [graph-database](), [hnsw](), [image-search](), [knn-algorithm](), [matching](), [microsoft-graph](), [neural-network](), [qdrant](), [rag](), [recommender-system](), [saas](), [simaes-networks](), [similarity](), [transformer](), [vector-search](), [vector-search-engine](), [vectors](), [word2vec](), [workflow-automation]() ### AI overview A case study of Data Graphs, a knowledge-graph-as-a-service platform that combines graph databases, full-text search, vector embeddings, workflow automation, and an agentic AI layer. It argues that effective Graph RAG should combine structured graph queries with semantic retrieval instead of relying on vector search alone. ### Source excerpt Data Graphs is a UK-based platform company that provides a knowledge graph-as-a-service polystore, built on a proprietary, high-performance graph database engine. Co-founded by Paul Wilton over 10 years ago as a consultancy, Data Graphs has evolved into a platform that serves industries ranging from sports media and publishing to GLAM (galleries, libraries, archives, museums), Agri-Tech, and Regulatory Technology. The Data Graphs platform combines a proprietary graph database, full-text search, vector embeddings, workflow automation, and an Agentic AI layer into a single, unified backbone for enterprise data. For organizations managing complex, highly connected data, the platform acts as both the system of record and the context layer that reasons across it. ## Using on-behalf-of flow for Entra-based MCP servers DevFeed: [Using on-behalf-of flow for Entra-based MCP servers]() Original publisher: [Read original article]() Author: Pamela Fox (noreply@blogger.com) Published: 2026-01-16T20:34:00Z Content type: tutorial Language: en Sources: [Pamela Fox]() Topics: [Entra ID](), [Model Context Protocol](), [MSP MCP](), [Why Rely on a Social Auth Library?]() Tags: [delegation](), [mcp](), [mcp-server](), [mcp-servers](), [microsoft-entra](), [microsoft-graph](), [oauth](), [oauth2](), [onedrive](), [pattern](), [python](), [sdk]() ### AI overview For a Python FastMCP MCP server that needs to call another API as the signed-in user, the excerpt identifies OAuth on-behalf-of (OBO), or delegation, as the mechanism--for example, to query Microsoft Graph. It explains that Microsoft Entra provides authorization server metadata but supports neither Dynamic Client Registration (DCR) nor Client ID Metadata Documents (CIMD). That is sufficient when the server is limited to pre-authorized clients; arbitrary MCP clients require DCR or CIMD. FastMCP addresses the DCR gap with an OAuth proxy that acts as the authorization server, forwards requests to Entra when needed, and stores client information in a designated database. The excerpt cuts off during its database example, so it does not establish implementation details beyond that. ### Source excerpt In December, we presented a series about MCP, culminating in a session about adding authentication to MCP servers. I demoed a Python MCP server that uses Microsoft Entra for authentication, requiring users to first login to the Microsoft tenant before they could use a tool. Many developers asked how they could take the Entra integration further, like to check the user's group membership or query their OneDrive. That requires using an "on-behalf-of" flow, also known as "delegation" in OAuth, where the MCP server uses the user's identity to call another API, like the Microsoft Graph API. In this blog post, I will explain how to use Entra with OBO flow in a Python FastMCP server. How MCP servers can use Entra authentication The MCP authorization specification is based on OAuth2, but with some additional features tacked on top. Every MCP client is actually an OAuth2 client, and each MCP server is an OAuth2 resource server. MCP auth adds these features to help clients determine how to authorize a server: Protected resource metadata (PRM): Implemented on the MCP server, provides details about the authorization server and method Authorization server metadata: Implemented on the authorization server, gives URLs for OAuth2 endpoints Additionally, to allow MCP servers to work with arbitrary MCP clients, MCP auth supports either of these client registration methods: Dynamic Client Registration (DCR): Implemented on the authorization server, it can register new MCP clients as OAuth2 clients, even if it hasn't seen them before. Client ID Metadata Documents (CIMD): An alternative to DCR, this requires both the MCP client to make a CIMD document available on a server, and requires the authorization server to fetch the CIMD document for details about the client. Microsoft Entra does support authorization server metadata, but it does not support either DCR or CIMD. That's actually fine if you are building an MCP server that's only going to be used with pre-authorized clients, like i