<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# MFA Bypass Detection — API Reference

## Azure AD Sign-In Log Fields

| Field | Description |
|-------|-------------|
| `resultType` | 0=success, 500121=MFA denied, 50074=MFA required |
| `clientAppUsed` | IMAP, POP3, Browser, Mobile App |
| `authenticationRequirement` | singleFactorAuthentication, multiFactorAuthentication |
| `deviceDetail.isCompliant` | Device compliance status |
| `location.countryOrRegion` | Geographic location |
| `riskState` | atRisk, confirmedCompromised, remediated |

## Microsoft Graph API

```bash
# Get sign-in logs
GET https://graph.microsoft.com/v1.0/auditLogs/signIns?\
$filter=createdDateTime ge 2026-03-01T00:00:00Z&\
$top=100&\
$orderby=createdDateTime desc

# Get MFA registration details
GET https://graph.microsoft.com/v1.0/reports/authenticationMethods/userRegistrationDetails

# Get risky sign-ins
GET https://graph.microsoft.com/v1.0/identityProtection/riskyUsers
```

## Conditional Access Policies

```bash
# List policies
GET https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies

# Block legacy authentication
POST https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies
{
  "displayName": "Block Legacy Auth",
  "conditions": {
    "clientAppTypes": ["exchangeActiveSync", "other"],
    "users": {"includeUsers": ["All"]}
  },
  "grantControls": {"builtInControls": ["block"]}
}
```

## Detection Tuning

| Detection | Threshold | Window | False Positive Rate |
|-----------|-----------|--------|---------------------|
| MFA fatigue | >5 denials | 5 min | Low |
| Legacy auth | Any success | Real-time | Very low |
| Impossible travel | 2+ countries | 1 hour | Medium |
| Device anomaly | Non-compliant post-MFA | Real-time | Medium |
| Token replay | Same token, diff device | Real-time | Low |
