Cloud identity attacks are shifting from password-based methods to token-based techniques, such as token theft, AiTM attacks, device code phishing, and ConsentFix, that bypass multi-factor authentication. This paper evaluates Microsoft Entra ID’s defense-in-depth strategy against token theft, focusing on Continuous Access Evaluation (CAE), Token Protection, and OAuth 2.0 compliance. Empirical testing reveals that CAE is supported by only 33 of 740 analyzed first-party resource providers, with revocation times varying widely across services (10 seconds for SharePoint/Teams to 5 minutes for Exchange). The study also shows that Token Protection’s default configuration can be partially bypassed via User-Agent manipulation or web client use. Additional gaps against current OAuth 2.0 best practices are identified, including reliance on proprietary mechanisms (PRT, FOCI, BroCI), coarse-grained scopes, limited BFF adoption, continued support for deprecated grant types, and the absence of refresh token rotation for public clients.