Microsoft Entra Device Registration authorization bypass via user-controlled key

#requires -Modules Microsoft.Graph.Authentication
[CmdletBinding()]
param(
    [int]$DaysBack = 30
)
$ErrorActionPreference = 'Stop'

function Test-GraphModule {
    if (-not (Get-Module -ListAvailable -Name Microsoft.Graph.Authentication)) {
        Write-Host 'UNKNOWN - Microsoft.Graph.Authentication module not installed'
        exit 3
    }
}

function Connect-Check {
    $ctx = Get-MgContext
    if (-not $ctx) {
        Write-Host 'UNKNOWN - Not connected to Microsoft Graph. Run Connect-MgGraph -Scopes ''AuditLog.Read.All'',''Directory.Read.All'' first.'
        exit 3
    }
}

function Inspect-DeviceRegistrationLogs {
    $since = (Get-Date).AddDays(-$DaysBack).ToUniversalTime()
    $filter = "activityDateTime ge $($since.ToString('yyyy-MM-ddTHH:mm:ssZ')) and activityDisplayName eq 'Add device'"
    try {
        $logs = Get-MgAuditLogDirectoryAudit -Filter $filter -All -ErrorAction Stop
    } catch {
        Write-Host "UNKNOWN - Failed to query Entra audit logs: $($_.Exception.Message)"
        exit 3
    }
    if ($null -eq $logs -or $logs.Count -eq 0) {
        Write-Host 'PATCHED - No Add device events in last' $DaysBack 'days'
        exit 0
    }
    $suspicious = @($logs | Where-Object {
        $_.InitiatedBy -and -not $_.InitiatedBy.User -and -not $_.InitiatedBy.App
    })
    if ($suspicious.Count -gt 0) {
        Write-Host 'VULNERABLE - Suspicious device registration events with missing initiator found; review these IDs:'
        $suspicious | Select-Object Id, ActivityDateTime, TargetResources | Format-List
        exit 1
    } else {
        Write-Host 'PATCHED - Device registration events found, none with missing initiator identity'
        exit 0
    }
}

Test-GraphModule
Connect-Check
Inspect-DeviceRegistrationLogs