Todyl reported that stolen application credentials and related Azure DevOps identity artifacts were used to access Microsoft Entra ID, Azure and Microsoft 365 environments, reaching 27 organizations represented in logs sent to the security provider. Todyl places the observed activity between November 1 and 3, 2026, and says it did not involve a Microsoft vulnerability. Todyl’s incident investigation covers environments that forwarded logs to the company.
What Todyl reported
Todyl said about 45 app registrations were targeted across roughly 18 organizations, with more than 33 successful authentications. Its investigation also counted searches across about 25 tenants, 81 downloaded files and access to approximately 2,279 mailbox items. These figures describe separate parts of the activity it observed.
The credentials and identity artifacts included application secrets, an Azure DevOps federated workload identity and replayed session tokens. App-only authentication lets an application identity, or service principal, sign in without a person present. Todyl reported that the activity used valid credentials rather than a Microsoft software vulnerability.
The reported activity, hour by hour
Todyl’s timestamps distinguish successful access and collection from later token-replay attempts it said Conditional Access blocked.
| Date and time (UTC) | Event Todyl reported |
| Nov. 1, 08:45 | First observed access using a stolen app credential. |
| Nov. 1, 14:39 | Use of an Azure DevOps federated workload identity. |
| Nov. 2, 10:39 | First observed replay of a user’s Azure DevOps session token. |
| Nov. 2, 17:40 | First Microsoft Graph search in a victim tenant. |
| Nov. 2, 20:36 | Bulk file downloads began at roughly one file per second. |
| Nov. 3, 07:56 | One MSP application swept 15 customer tenants in repeated loops. |
| Nov. 3, 15:16 | Last successful action in Todyl’s update: app-only downloads at one MSP. |
| Nov. 3, 18:12 | Multiple users’ refresh-token replay attempts were blocked by Conditional Access. |
| Nov. 3, 21:31 | Latest attempt recorded in the update was blocked. |
Todyl described a common token sequence beginning with Azure Resource Manager and Key Vault, often followed by Microsoft Graph, Storage and Cognitive Services. It said Key Vault reads may have supplied credentials used later; audit logs are needed to confirm that link.
Why app-only sign-ins need separate attention
Employee sign-ins and app-only sign-ins are different identity paths. Because an application can authenticate without a human user, user-focused MFA and Conditional Access policies do not automatically cover that app access, according to Todyl.
Todyl’s guidance says workload-identity Conditional Access requires the standalone Workload ID Premium license and direct assignment to service principals. Group assignment is not enforced for them. The policies cover single-tenant apps registered in the tenant, but not managed identities, multitenant apps or third-party SaaS. Administrators assessing coverage therefore need to check each identity type and how its policy is assigned.
