Abusing Entra OAuth for fun and access to internal Microsoft applications