Use CISA's official AA23-193A advisory. Verify the triggering audit event, anomalous fields, token-forging mechanism, Microsoft's response, the report's detection limitation, and stated logging and retention requirements.