Detects off-box replay of a device-bound Primary Refresh Token (PRT) by a first-party Entra ID client to redeem tokens for Microsoft Graph, SharePoint/OneDrive, or Exchange Online from an IP not associated with the user’s Windows Sign-In/WAM session. Replay events are limited to compliant or Intune-managed devices; the PRT-bound deviceid means the workstation may still satisfy Conditional Access, enabling token use from a different host. The rule targets known first-party clients (Azure CLI, Azure PowerShell, Visual Studio Code, Graph CLI, Azure AD PowerShell, Visual Studio) and excludes several Microsoft 365 clients that routinely egress on different IPs. It uses Azure Sign-In Logs to correlate two streams: (1) a Windows Sign-In/WAM device-session event and (2) a PRT replay event where app_id corresponds to a first-party client and resource_id corresponds to Graph, SharePoint Online, OneDrive for Business, or Exchange Online; requires incoming_token_type = primaryRefreshToken and device_detail.is_compliant or is_managed = true. The detection aggregates by user and device, collecting device-session IPs and replay IPs, then expands replay IPs and filters out any IPs that also appeared in the device-session set. Results highlight off-box replay IPs, the associated user, and device identifiers for incident response. The rule explicitly notes this is not a phishing or OAuth-code flow and highlights the typical five-minute PRT replay window. It provides investigation guidance, false positives to consider (e.g., jump hosts, VPNs, split-tunnel setups, or omitted clients), and remediation steps (revoke tokens, isolate the workstation, and hunt for related BrowserCore/Harvest activity).