Microsoft Entra Connect Health

operationName	Description	Sample	Rule
Microsoft.ADHybridHealthService/addsservices/action	Create a new forest for the tenant.	N	N
Microsoft.ADHybridHealthService/addsservices/delete	Deletes a Service and it's servers along with Health data.	N	N
Microsoft.ADHybridHealthService/addsservices/servicemembers/action	Add a server instance to the service.	N	N
Microsoft.ADHybridHealthService/addsservices/servicemembers/delete	Deletes a server for a given service and tenant.	N	N
Microsoft.ADHybridHealthService/addsservices/write	Creates or Updates the ADDomainService instance for the tenant.	N	N
Microsoft.ADHybridHealthService/configuration/action	Updates Tenant Configuration.	N	N
Microsoft.ADHybridHealthService/configuration/write	Creates a Tenant Configuration.	N	N
Microsoft.ADHybridHealthService/register/action	Registers the ADHybrid Health Service Resource Provider and enables the creation of ADHybrid Health Service resource.	N	N
Microsoft.ADHybridHealthService/services/action	Updates a service instance in the tenant.	N	N
Microsoft.ADHybridHealthService/services/delete	Deletes a service instance in the tenant.	N	Y
Microsoft.ADHybridHealthService/services/ipAddressAggregateSettings/write	Writes alarm thresholds for bad IPs.	N	N
Microsoft.ADHybridHealthService/services/monitoringconfiguration/write	Add or updates monitoring configuration for a service.	N	N
Microsoft.ADHybridHealthService/services/monitoringconfigurations/write	Add or updates monitoring configurations for a service.	N	N
Microsoft.ADHybridHealthService/services/reports/generateBlobUri/action	Generates Risky IP report and returns a URI pointing to it.	N	N
Microsoft.ADHybridHealthService/services/servicemembers/action	Creates or updates a server instance in the service.	N	Y
Microsoft.ADHybridHealthService/services/servicemembers/delete	Deletes a server instance in the service.	N	N
Microsoft.ADHybridHealthService/services/write	Creates a service instance in the tenant.	N	N
Microsoft.ADHybridHealthService/unregister/action	Unregisters the subscription for ADHybrid Health Service Resource Provider.	N	N

Microsoft.ADHybridHealthService/addsservices/action

Namespace: Microsoft.ADHybridHealthService

Description

Create a new forest for the tenant.

Microsoft.ADHybridHealthService/addsservices/delete

Namespace: Microsoft.ADHybridHealthService

Description

Deletes a Service and it's servers along with Health data.

Microsoft.ADHybridHealthService/addsservices/servicemembers/action

Namespace: Microsoft.ADHybridHealthService

Description

Add a server instance to the service.

Microsoft.ADHybridHealthService/addsservices/servicemembers/delete

Namespace: Microsoft.ADHybridHealthService

Description

Deletes a server for a given service and tenant.

Microsoft.ADHybridHealthService/addsservices/write

Namespace: Microsoft.ADHybridHealthService

Description

Creates or Updates the ADDomainService instance for the tenant.

Microsoft.ADHybridHealthService/configuration/action

Namespace: Microsoft.ADHybridHealthService

Description

Updates Tenant Configuration.

Microsoft.ADHybridHealthService/configuration/write

Namespace: Microsoft.ADHybridHealthService

Description

Creates a Tenant Configuration.

Microsoft.ADHybridHealthService/register/action

Namespace: Microsoft.ADHybridHealthService

Description

Registers the ADHybrid Health Service Resource Provider and enables the creation of ADHybrid Health Service resource.

Microsoft.ADHybridHealthService/services/action

Namespace: Microsoft.ADHybridHealthService

Description

Updates a service instance in the tenant.

Microsoft.ADHybridHealthService/services/delete

Namespace: Microsoft.ADHybridHealthService

Description

Deletes a service instance in the tenant.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete schema for this catalog entry.

Name	Rules	Vendors
`CategoryValue`	3 detection rules	Kusto, Sigma
`OperationNameValue`	3 detection rules	Kusto, Sigma
`ResourceProviderValue`	3 detection rules	Kusto, Sigma
`_ResourceId`	2 detection rules	Kusto

Common Indicators #

Positive field/value combinations most frequently checked by detection rules attached to this catalog entry, derived from cross-vendor predicate analysis. This is separate from Fields accounting, which also includes exclusions and counts distinct attached rules.

Field	Kind	Value	Rules	Vendors
`CategoryValue`	eq	`Administrative`	3 rules	kusto, sigma
`_ResourceId` (kusto rule field)	contains	`AdFederationService`	2 rules	kusto
`azure_ad::operation_name_value`	eq	`Microsoft.ADHybridHealthService/services/delete`	2 rules	kusto, sigma
`ResourceId` (sigma rule field)	contains	`AdFederationService`	1 rule	sigma

Detection Rules #

Full rule details for this catalog entry, including ATT&CK technique mappings and native queries →

Sigma #

Azure Active Directory Hybrid Health AD FS Service Delete source medium: This detection uses azureactivity logs (Administrative category) to identify the deletion of an Azure AD Hybrid health AD FS service instance in a tenant. A threat actor can create a new AD Health ADFS service and create a fake server to spoof AD FS signing logs. The health AD FS service can then be deleted after it is not longer needed via HTTP requests to Azure.T1578, T1578.003

Kusto #

Microsoft Entra ID Hybrid Health AD FS Service Delete source medium: This detection uses AzureActivity logs (Administrative category) to identify the deletion of an Microsoft Entra ID Hybrid Health AD FS service instance in a tenant. A threat actor can create a new AD Health ADFS service and create a fake server to spoof AD FS signing logs. The health AD FS service can then be deleted after it is no longer needed via HTTP requests to Azure. More information is available in this blog https://o365blog.com/post/hybridhealthagent/T1578, T1578.003
Microsoft Entra ID Hybrid Health AD FS Suspicious Application source medium: This detection uses AzureActivity logs (Administrative category) to identify a suspicious application adding a server instance to an Microsoft Entra ID Hybrid Health AD FS service or deleting the AD FS service instance. Usually the Microsoft Entra ID Connect Health Agent application with ID cf6d7e68-f018-4e0a-a7b3-126e053fb88d and ID cb1056e2-e479-49de-ae31-7812af012ed8 is used to perform those operations.T1528, T1550↳ also matches Microsoft.ADHybridHealthService/services/servicemembers/action

Microsoft.ADHybridHealthService/services/ipAddressAggregateSettings/write

Namespace: Microsoft.ADHybridHealthService

Description

Writes alarm thresholds for bad IPs.

Microsoft.ADHybridHealthService/services/monitoringconfiguration/write

Namespace: Microsoft.ADHybridHealthService

Description

Add or updates monitoring configuration for a service.

Microsoft.ADHybridHealthService/services/monitoringconfigurations/write

Namespace: Microsoft.ADHybridHealthService

Description

Add or updates monitoring configurations for a service.

Microsoft.ADHybridHealthService/services/reports/generateBlobUri/action

Namespace: Microsoft.ADHybridHealthService

Description

Generates Risky IP report and returns a URI pointing to it.

Microsoft.ADHybridHealthService/services/servicemembers/action

Namespace: Microsoft.ADHybridHealthService

Description

Creates or updates a server instance in the service.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete schema for this catalog entry.

Name	Rules	Vendors
`CategoryValue`	4 detection rules	Kusto, Sigma
`OperationNameValue`	4 detection rules	Kusto, Sigma
`ResourceProviderValue`	4 detection rules	Kusto, Sigma
`_ResourceId`	3 detection rules	Kusto

Common Indicators #

Field	Kind	Value	Rules	Vendors
`CategoryValue`	eq	`Administrative`	4 rules	kusto, sigma
`_ResourceId` (kusto rule field)	contains	`AdFederationService`	3 rules	kusto
`azure_ad::operation_name_value`	eq	`Microsoft.ADHybridHealthService/services/servicemembers/action`	3 rules	kusto, sigma
`ResourceId` (sigma rule field)	contains	`AdFederationService`	1 rule	sigma

Detection Rules #

Full rule details for this catalog entry, including ATT&CK technique mappings and native queries →

Sigma #

Azure Active Directory Hybrid Health AD FS New Server source medium: This detection uses azureactivity logs (Administrative category) to identify the creation or update of a server instance in an Azure AD Hybrid health AD FS service. A threat actor can create a new AD Health ADFS service and create a fake server instance to spoof AD FS signing logs. There is no need to compromise an on-prem AD FS server. This can be done programmatically via HTTP requests to Azure.T1578

Kusto #

Microsoft Entra ID Hybrid Health AD FS New Server source medium: This detection uses AzureActivity logs (Administrative category) to identify the creation or update of a server instance in an Microsoft Entra ID Hybrid Health AD FS service. A threat actor can create a new AD Health ADFS service and create a fake server instance to spoof AD FS signing logs. There is no need to compromise an on-premises AD FS server. This can be done programmatically via HTTP requests to Azure. More information in this blog: https://o365blog.com/post/hybridhealthagent/T1578
NRT Microsoft Entra ID Hybrid Health AD FS New Server source medium: This detection uses AzureActivity logs (Administrative category) to identify the creation or update of a server instance in an Microsoft Entra ID Hybrid Health AD FS service. A threat actor can create a new AD Health ADFS service and create a fake server instance to spoof AD FS signing logs. There is no need to compromise an on-premises AD FS server. This can be done programmatically via HTTP requests to Azure. More information in this blog: https://o365blog.com/post/hybridhealthagent/T1578
Microsoft Entra ID Hybrid Health AD FS Suspicious Application source medium: This detection uses AzureActivity logs (Administrative category) to identify a suspicious application adding a server instance to an Microsoft Entra ID Hybrid Health AD FS service or deleting the AD FS service instance. Usually the Microsoft Entra ID Connect Health Agent application with ID cf6d7e68-f018-4e0a-a7b3-126e053fb88d and ID cb1056e2-e479-49de-ae31-7812af012ed8 is used to perform those operations.T1528, T1550↳ also matches Microsoft.ADHybridHealthService/services/delete

Microsoft.ADHybridHealthService/services/servicemembers/delete

Namespace: Microsoft.ADHybridHealthService

Description

Deletes a server instance in the service.

Microsoft.ADHybridHealthService/services/write

Namespace: Microsoft.ADHybridHealthService

Description

Creates a service instance in the tenant.

Microsoft.ADHybridHealthService/unregister/action

Namespace: Microsoft.ADHybridHealthService

Description

Unregisters the subscription for ADHybrid Health Service Resource Provider.

any: Microsoft Entra Connect Health (catch-all)

Scope grouping: This repository-authored catalog entry represents a broad attribution scope, not a distinct emitted event or operation. Any sample below is a representative record from that scope; attached rules, if any, are listed separately.

Namespace: Microsoft.ADHybridHealthService

Description

Catch-all for Azure-Microsoft.ADHybridHealthService rules that match the resource provider but no specific operation.

Microsoft Entra Connect Health

Microsoft.ADHybridHealthService/addsservices/action

Description

Microsoft.ADHybridHealthService/addsservices/delete

Description

Microsoft.ADHybridHealthService/addsservices/servicemembers/action

Description

Microsoft.ADHybridHealthService/addsservices/servicemembers/delete

Description

Microsoft.ADHybridHealthService/addsservices/write

Description

Microsoft.ADHybridHealthService/configuration/action

Description

Microsoft.ADHybridHealthService/configuration/write

Description

Microsoft.ADHybridHealthService/register/action

Description

Microsoft.ADHybridHealthService/services/action

Description

Microsoft.ADHybridHealthService/services/delete

Description

Detection Fields #

Common Indicators #

Related events #

Detection Rules #

Sigma #

Kusto #

Microsoft.ADHybridHealthService/services/ipAddressAggregateSettings/write

Description

Microsoft.ADHybridHealthService/services/monitoringconfiguration/write

Description

Microsoft.ADHybridHealthService/services/monitoringconfigurations/write

Description

Microsoft.ADHybridHealthService/services/reports/generateBlobUri/action

Description

Microsoft.ADHybridHealthService/services/servicemembers/action

Description

Detection Fields #

Common Indicators #

Related events #

Detection Rules #

Sigma #

Kusto #

Microsoft.ADHybridHealthService/services/servicemembers/delete

Description

Microsoft.ADHybridHealthService/services/write

Description

Microsoft.ADHybridHealthService/unregister/action

Description

any: Microsoft Entra Connect Health (catch-all)

Description

References #