A mailbox is still being read a week after the password rotation and MFA re-registration — what does the operator hold?

## Read the negative evidence first Two remediations were performed and the access continued. That is not a failure of execution; it is information. - A **password rotation** invalidates a credential. Access continued, so a credential is not what is being used. - **Re-registering the second factor** changes what is required at authentication. Access continued, so no authentication is occurring at all. The set of access artefacts that survive both is small, and a delegated authorization held by an application is the leading member of it. A browser session cookie would be a plausible competitor for a few hours, but not a week, and a cookie belongs to a browser that has long since been reset. ## The two properties that set the scale Once you accept the classification, the interesting question is not *what is it* but *how big is it*. A consent grant record answers that. **Consent type.** A grant consented by an individual for themselves covers exactly that principal. A grant consented by an administrator on behalf of the organisation covers every principal, and the record shows this as a tenant-wide consent with no individual principal attached. The difference between those two values, in a mail-read scope, is the difference between one mailbox and the entire company's mail. Candidates who stop at "they have a grant" have not yet said anything actionable. **Where the application lives.** If the operator registered a multi-tenant application, your directory holds a service principal for it, but the application registration itself — its name, its owner, its redirect targets, its ability to be granted again tomorrow by a different user — lives in a directory you do not control. You can remove your side. You cannot remove theirs, and the same application can be re-consented by the next person who receives the lure. Also worth pulling from the record: when the grant was created, which tells you the real start of access rather than the date somebody noticed, and which scopes it carries, since a scope set including offline access is what gives the refresh token its long life. ## What this shape predicts about the rest of the estate This is where a senior answer separates from a competent one. The technique implies a position, and the position implies absences: - **No host was compromised.** No code ran on an endpoint, so there is nothing to reimage, no persistence mechanism to remove from a host, and no malware to identify. - **No lateral movement happened.** The operator never held network position. Reconstructing a path through the estate is wasted effort. - **The reach is scope-shaped, not network-shaped.** Ask what those scopes permit, not what subnet anything sits on. - **A crew operating this way is usually monetising data, not disruption.** Data-theft extortion without an encryptor is a coherent business: the leverage is publication, so the absence of anything destructive is not reassurance that the intrusion is minor. ## Getting the direction of each claim right Be precise about what the record proves. A grant record proves an authorization was recorded for a principal at a time. It does not prove the user understood the request, does not prove the operator has used it recently, and does not prove they have not also obtained something else by another route. Equally, the successful password rotation proves the credential changed; it proves nothing about outstanding authorizations, which is exactly why it did not help. ## Where this stops Removing the grant, cleaning up mail rules, and deciding when to declare the access ended are an access-removal exercise owned elsewhere in the response process. What belongs to the classification chair is naming the correct object, sizing it with the consent type, and telling the administrator who is about to act why the credential path removed nothing. ## Common wrong answers - "Rotate the password again and force sign-out everywhere." Sign-out ends sessions; the application is not in a session. - "Reimage their laptop." There is no evidence of anything on the laptop, and this shape of access does not require one. - "It is an insider, because it survived everything." Persistence through credential changes is a property of the artefact, not evidence of who holds it. - "One user consented, so one user is affected." Only true once you have read the consent type; the alternative value changes the answer by three orders of magnitude.