Attackers are trying out a new technique to widen the reach of their phishing campaigns: by using stolen Office 365 credentials, they try to connect rogue Windows devices to the victim organizations’ network by registering it with their Azure AD.
Source: https://www.helpnetsecurity.com/2022/01/27/rogue-devices-organizations/