Key takeaways
OAuth client ID spoofing defeats detections that key off application name or a known application ID, because the field itself is fabricated, rotated or blank.
AADSTS700016 paired with an unrecognized client ID can mean valid credentials, not a broken app registration — treat it as a triage signal, not noise.
Effective detection logic correlates client ID cardinality, missing application names and AADSTS error sequences across a time window, not any single event.
A rehearsed response runbook (reset, revoke, review) matters as much as the detection query itself, and the cost of skipping it shows up as account takeover, not just alert fatigue.
The signal hiding in plain sight
Pict...