Preliminary research

Nested APP Authentication — Undocumented Risk and Conditional Access Bypass

Nested APP Authentication — Undocumented Risk and Conditional Access Bypass (Talk-page copy)

Shang-De Jiang and Jun Sheng Shi · TROOPERS

AI-collected research leads through 22 September 2026, including targeted additions between broader sweeps. Unranked, incomplete, not community-vetted, and subject to change.

Conference page for a study of Microsoft Nested App Authentication. The associated presentation varies broker, nested-client and resource identities and compares Conditional Access inclusion and exclusion policies. Exploitation assumes a usable refresh token and delegated permissions; the tests do not show universal policy bypass.

Record

Document

Nested APP Authentication — Undocumented Risk and Conditional Access Bypass (Talk-page copy)

Researcher

Shang-De Jiang and Jun Sheng Shi

Published by

TROOPERS

Topic

Identity

In the archive

• Collected in the 2026 preliminary research sweep

Related sources

• Nested APP Authentication — Undocumented Risk and Conditional Access Bypass (Slides) Whitepaper

Tags

• oauth
• azure
• sso
• identity
• auth-bypass
• case-study
• owasp-a01-2021
• owasp-a07-2021

This page is the archive's own catalogue record. The research is the work of Shang-De Jiang and Jun Sheng Shi, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 13 September 2026.