- Lack of timely key rotation The lack of scope checking seems especially egregious. It sounds like any number of keys would have been incorrectly trusted. If

- Lack of timely key rotation The lack of scope checking seems especially egregious. It sounds like any number of keys would have been incorrectly trusted. If it was an RSA key that signed JWTs which it sounds like or similar, Microsoft has an issuer endpoint for all customers and it's critical to check the issuer/scope for those since any number of things can create a token with a valid signature.