A Debug Flag Shipped to Prod Turned M365 Android Apps Into a Token Buffet

Someone forgot to flip a switch.

That is the entire story, and also the part that should make every mobile platform team uncomfortable. Several Microsoft 365 Android apps shipped to the Play Store with a development-only flag still enabled in production builds. The flag disabled the check that restricts account-token sharing to a trusted set of Microsoft-signed apps. With it off, any other app installed on the device could request the signed-in user's token through the standard inter-app token broker flow and walk away with it.

No OAuth consent screen. No biometric. No notification. Just an IPC call answered too generously.

The blast radius here is the user's entire Microsoft 365 surface. Mail through Outlook. Files in OneDrive and SharePoint. Calendar. Teams messages sent as the user. The token is a graph token tied to the account, so anything the user can do, the malicious app can do — silently, in the background, with no audit signal that screams compromise. In practice, the SOC sees legitimate Graph API activity from a legitimate user session. That is the worst kind of detection problem.

The failure mode here is boring and familiar: a debug affordance designed to make local development less painful never got gated behind a build variant. It is the Android equivalent of leaving an S3 bucket world-readable because someone needed to test a webhook. The mechanism is different. The root cause is identical. CI did not catch it. Code review did not catch it. The release checklist did not catch it.

One thing the post-mortem will say is that the trusted-caller allowlist should have been enforced at the SDK layer, not as an opt-in check that an app team can disable. When the safety belt lives in app code, every app team is one merge away from disabling it. When it lives in the broker, you have to actively bypass it.

If you run Intune or any mobile threat defense product, this is the moment to actually look at what other apps are installed on managed devices alongside the Microsoft 365 suite. App allowlisting on corporate Android is the mitigation that would have neutered this whole class of bug. Conditional Access policies tied to device compliance help too, but only if your compliance signal is honest.

For the affected accounts, token rotation is the only real cleanup. Revoke refresh tokens, force reauth, and audit Graph API activity for the window the vulnerable builds were live. The Microsoft Authenticator and Microsoft Graph activity logs are where you start — sign-in logs alone will not show this because the attacker never signs in.

Operational takeaway: if your release pipeline cannot answer the question "are any debug flags still set in this artifact?" before it hits the store, you are one PR away from being the next advisory.