Detects first-party Entra ID tooling clients redeeming a device-bound Primary Refresh Token (PRT) for Microsoft Graph, SharePoint/OneDrive, or Exchange Online from a source IP that has not appeared with that device_id in the prior five days. The rule targets WAM-based cookie replay where the token remains bound to the original workstation device_id, enabling conditional access only if the device is compliant or managed. Unlike the related replay rule, this does not require a Windows sign-in or a Windows-AzureAD auth provider event in the same window, so a host that signed in yesterday can still trigger on a new IP. Attackers often obtain a PRT cookie via methods like PRTremote and post it from attacker infrastructure; the cookie nonce is generally valid for around five minutes, creating a limited window for abuse. The rule maps to MITRE techniques involving stealing application access tokens and web session cookies, while also covering cloud account initial access and defense evasion. The detection relies on Azure SignInLogs data, specifically tokens of type primaryRefreshToken, device_id bindings, and device compliance/management flags, in combination with source IP and the tooling app identifiers. The rule provides guidance for investigation, false positives, and remediation steps to validate the event and respond appropriately.