The culprit was Socat.
Microsoft Entra Socat acts as the secure bridge between your identity layer and the network transport it depends on. It is a versatile command-line utility that relays data between two sockets. With Socat integrated into Microsoft Entra’s access workflows, you can create encrypted, authenticated tunnels that enforce identity policies at the transport level.
Socat works as an endpoint-to-endpoint relay. It listens on one side, sends data to the other, and supports protocols that Microsoft Entra can validate against your identity provider. This makes it ideal for scenarios where you need secure forwarding of traffic between systems that require compliance with cloud identity and conditional access rules.
The power comes from pairing Socat’s simple syntax with Microsoft Entra’s controls. You can initiate a Socat command to bind a local port, encrypt the tunnel with TLS, and restrict usage to accounts that meet Entra security conditions. The result is a reliable, auditable link for services that cannot expose themselves directly to public networks.