The attack was particularly concerning because Microsoft revealed that the attacker was forging Azure AD tokens using an acquired Microsoft account signing key. In Microsoft's words, "Though the key was intended only for MSA accounts, a validation issue allowed this key to be trusted for signing Azure AD tokens. This issue has been corrected."