Microsoft ID Security Gaps That Let Threat Actor Steal Signing Key

China's Storm-0558 accessed user emails at some 25 enterprise organizations earlier this year using forged tokens.

https://www.darkreading.com/attacks-breaches/microsoft-ids-security-gaps-that-let-threat-actor-steal-signing-key