1) Federation TrustsMicrosoft has observed the actor adding new federation trusts to an existing tenant or modifying the properties of an existing federation trust to accept tokens signed with actor-owned certificates. 2) Microsoft has observed the actor adding new federation trusts to an existing tenant or modifying the properties of an existing federation trust to accept tokens signed with actor-owned certificates. Examples include mail archiving applications. Permissions are usually, but not always, AppOnly.The actor may use their administrator privileges to grant additional permissions to the target Application or Service Principal (e.g. Examples include mail archiving applications. Permissions are usually, but not always, AppOnly. 5) The actor may use their administrator privileges to grant additional permissions to the target Application or Service Principal (e.g. Mail.Read, Mail.ReadWrite