Pass-the-PRT uses a stolen Primary Refresh Token to impersonate a user in Entra ID and related Microsoft cloud services. If an attacker obtains the token from a compromised device or session, they can access cloud resources without the password. Defenders should protect endpoints, enforce conditional access, and revoke compromised sessions quickly.
How Pass-the-PRT Actually Works
Pass-the-PRT is a token replay technique, not a password-cracking technique. The attacker steals a Primary Refresh Token from a compromised device or active session, then uses that token to impersonate the user in Entra ID and downstream Microsoft cloud services. Because the token already represents an authenticated session, access can continue without re-entering the password.
The key point is that the attacker is abusing an already-issued trust artifact. A PRT is valuable because it can bridge endpoint compromise into cloud access, especially when the device is trusted or the session remains valid. That makes endpoint security, session hygiene, and rapid revocation the practical boundaries of defense.
What Makes a Stolen PRT So Dangerous
A stolen PRT can turn one foothold into broad cloud reach if the token is accepted by services the user already uses. The blast radius depends on what the user could access, whether conditional access was already satisfied, and how quickly the compromise is detected. In practice, the token becomes a shortcut around interactive authentication.
Pass-the-PRT is especially effective when defenders rely too heavily on password changes alone. If the token is still valid, changing the password may not immediately stop the session that was already established. That is why this technique is closely tied to session theft, device compromise, and persistence rather than just credential theft.
How Defenders Break the Attack Chain
Stopping Pass-the-PRT means protecting both the endpoint and the cloud session state. Strong device security, credential theft prevention, and monitoring for token abuse matter because the initial theft usually happens on a compromised machine, then the stolen token is reused from elsewhere. Conditional access helps, but it must be paired with session revocation and investigation.
Defenders should also treat any confirmed token theft as a possible identity compromise event, not a routine login issue. If a PRT was exposed, the response should focus on invalidating the session, checking for abnormal cloud access, and confirming whether the attacker used the token to move into mail, files, chat, or admin workflows before the token was revoked.
Risk and Threat Considerations
Pass-the-PRT matters because it converts endpoint compromise into authenticated cloud access with very little friction for the attacker. The risk is highest when the stolen token still has usable lifetime and the environment does not rapidly revoke sessions or detect anomalous reuse.
Failure mechanism: An attacker extracts the PRT from a compromised device or session, replays it to Entra ID, and inherits the user’s authenticated cloud access without needing the password.
Impact: The attacker can access cloud resources as the victim, sustain persistence across password changes, and potentially expand into data theft, mailbox abuse, or further privilege abuse until the session is invalidated.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | PRTs are session-bearing authenticators that must be protected and revoked quickly. |
| IA-9 — Service Identification and Authentication | The attack abuses authenticated access to cloud services after token replay. | |
| AC-2 — Account Management | Compromised user accounts and sessions must be disabled or constrained fast. | |
| Recommendation — Manage token lifecycle tightly and revoke exposed authenticators immediately. Enforce strong authentication for service access and detect token replay. Remove or constrain compromised accounts and sessions without delay. | ||
| NIST CSF 2.0 | PR.AA-01 — Identities and credentials are issued, managed, verified, revoked, and audited | Pass-the-PRT depends on credential and session lifecycle gaps. |
| DE.CM-01 — Networks and environments are monitored to find potential cybersecurity events | Detection of abnormal token reuse and cloud access is central to response. | |
| Recommendation — Audit credential and session lifecycle controls so stolen tokens lose value quickly. Monitor for anomalous sign-ins and token reuse indicative of session theft. | ||
Practitioner Guidance
What to verify: Confirm whether the compromise started on an endpoint, whether the user’s cloud session is still active, and whether the same identity shows suspicious sign-ins, unfamiliar device signals, or unusual resource access after the token was stolen.
Decision rule: If a PRT theft is suspected, prioritize session revocation and endpoint containment before assuming password reset alone is sufficient. If the user has elevated access or accesses sensitive data, treat the event as a high-severity identity incident.
Practitioner takeaway: The defensive question is not whether the password changed, but whether the attacker still has a valid trust artifact that can keep authenticating until you remove the session and contain the device.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 18, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org