A clean sign-in dashboard can still hide an active credential attack.
The dashboard may be measuring the wrong event.
I have seen systems where "no successful login" was treated as evidence that access was safe. That assumption is weaker now. Proofpoint has documented at least two threat actor groups spoofing OAuth client IDs against Entra ID: they send a username and password to the token endpoint with a fabricated application ID, and read the error that comes back. One error means the username does not exist. Another means the username is real but the password is wrong. A third — "application identifier not recognized" — means both were correct.
The credential is confirmed. No successful sign-in is recorded. And because the application ID was invented, the application name field in the log comes back blank, so detections tuned to watch a named application see nothing worth flagging.
The systems lesson is not about one identity provider. Telemetry tends to observe the event we named rather than the protocol we exposed: client identity, token endpoint, grant type, failed validation patterns, refresh tokens, and the session activity that follows. Watching only the final login is like monitoring payments only after settlement.
Passwordless authentication helps. It does not remove OAuth, token, application-identity, or telemetry risk.
An identity control is only as strong as the paths the organization can actually see.