How Attackers Use Microsoft Graph API to Expose Information: Circumventing Two-Factor Authentication to Access Sensitive Data
Many organizations have adopted Microsoft 365 as a central platform for daily operations, relying on security mechanisms such as Two-Factor Authentication (2FA) to protect their data. 2FA is one of the most critical layers in modern security architecture, designed to ensure that even if a password is stolen, an attacker cannot access the account without additional verification. In this article, we reveal how attackers can bypass 2FA protections to steal sensitive information, such as an organization’s complete user directory.
The Hidden Flaw: When 2FA is Enabled—But Doesn’t Cover All Entry Points
When an organization enables 2FA in Microsoft 365, users are required to undergo an additional verification step—such as an SMS code, an authenticator app, or a phone call—before accessing services like Outlook, Teams, or the Azure management interface. However, many are unaware that 2FA does not necessarily apply to all system access points.
A prominent example is the Microsoft Graph API—the unified API gateway for accessing data and services across Microsoft 365 and Azure Active Directory (now Microsoft Entra ID). The Graph API is designed to allow developers to perform operations such as data retrieval, user management, and automation—for instance, exporting a full list of users, including roles, email addresses, and other details.
Attackers sometimes obtain a user’s credentials but are blocked from logging in due to 2FA. Nevertheless, they can bypass this protection using the Microsoft Graph API to extract sensitive information from the system without requiring additional authentication.
Attack Scenario: How It Happens in Practice
How attackers use API requests to extract information:
The attack scenario is simpler than it seems. Suppose an attacker obtains a user’s credentials through a brute-force attack or phishing. If 2FA is partially configured or does not apply to all access points—specifically Microsoft Graph API—the attacker may exploit this by querying the API with requests such as:
`GET https://graph.microsoft.com/v1.0/users`
Such a call can return a list of all users in the organization, including names, titles, email addresses, and further details, depending on the permissions of the compromised account. In some cases, if the account has administrative privileges, the attacker may perform additional actions, such as modifying settings, creating new users, or extracting files stored in the cloud.
An example of this can be found in organizations using “Security Defaults”—default settings enabled in the free version of Microsoft Entra ID. While these settings enforce 2FA, they do not include Conditional Access policies, which are only available with Premium licenses. Consequently, there is a specific lack of control over access to the Microsoft Graph API.
Case Study
During an external penetration test performed for one of our clients, a security expert obtained the credentials of several users. Although the attempt to log in through the Microsoft 365 portal was successfully blocked by 2FA, a significant security gap was discovered: the expert was still able to extract sensitive information from Azure Active Directory without further authentication.
A deeper investigation revealed that one of the organization’s developers had created an internal application designed to connect to Microsoft 365 services via the Microsoft Graph API. The application was configured to operate with access permissions through a specific group of users, but 2FA policies were not applied to it. As a result, any user in that group—including those whose credentials were compromised—could query the Graph API and extract data from Azure AD, such as user lists, roles, and additional account details.
Recommendations from IPV Security Experts:
1. Enable Conditional Access: Define policies that require 2FA specifically for Graph API access, not just for services like Email or Teams.
2. Permission Audit: Ensure that accounts with Graph API access are limited to the principle of least privilege, removing unnecessary permissions that could serve as an attack vector.
3. Conduct Regular Penetration Testing: These tests expose vulnerabilities, such as the absence of 2FA in Graph API queries, allowing for remediation before a real attacker exploits the breach.
Summary
Two-Factor Authentication is a critical layer of defense that must be implemented comprehensively across all organizational service access points, including Microsoft 365 accounts and the Graph API. It is an essential barrier ensuring that even if a password is leaked, unauthorized access is blocked. Any exception to this defense can become a vulnerability leading detect to an organizational breach or sensitive data leak. Therefore, consistent enforcement of 2FA, without exceptions, is more than just a recommendation—it is a necessity for corporate data security in an era of escalating cyber threats.