Defender-IdentityInfo

ActionType	Title	Sample	Rule
any	Identity information	Y	Y

any: Identity information

Table: IdentityInfo

Fields #

Name	Description
`Timestamp`
`ReportId`
`AccountObjectId`
`AccountUpn`
`OnPremSid`
`AccountDisplayName`
`AccountName`
`AccountDomain`
`CriticalityLevel`
`DistinguishedName`
`CloudSid`
`GivenName`
`Surname`
`Department`
`JobTitle`
`EmailAddress`
`City`
`Country`
`IsAccountEnabled`
`Manager`
`CreatedDateTime`
`SourceProvider`
`ChangeSource`
`RiskLevel`
`RiskLevelDetails`
`Tags`
`AssignedRoles`
`GroupMembership`

Example Event #

{
  "AccountDisplayName": "Admin User",
  "AccountDomain": "example.onmicrosoft.com",
  "AccountName": "Admin User",
  "AccountObjectId": "11111111-1111-1111-1111-111111111111",
  "AccountUpn": "adminuser@example.onmicrosoft.com",
  "AssignedRoles": [
    "Global Administrator"
  ],
  "AssignedRoles@odata.type": "#Collection(String)",
  "ChangeSource": "AzureActiveDirectory",
  "CloudSid": "S-1-12-1-2203833961-1078582856-4269134526-4172038298",
  "CreatedDateTime": "2026-01-17T02:18:03Z",
  "CriticalityLevel": 0,
  "EmailAddress": "adminuser@example.onmicrosoft.com",
  "GivenName": "Admin",
  "IdentityEnvironment": "Cloud",
  "IdentityId": "User_00000000-0000-0000-0000-000000000001_678ad294-74ae-4dbd-b59a-8e861a00b5e0",
  "IsAccountEnabled": 1,
  "IsAccountEnabled@odata.type": "#SByte",
  "Phone": "4085680442",
  "ReportId": "90b0aba9-1b2e-44f6-93aa-ee0de4ecea16",
  "RiskScore": 100,
  "RiskScoreUpdateTime": "2026-07-28T10:09:58.0875151Z",
  "SourceProvider": "AzureActiveDirectory",
  "SourceProviders": [
    "AzureActiveDirectory"
  ],
  "SourceProviders@odata.type": "#Collection(String)",
  "Surname": "User",
  "Tags@odata.type": "#Collection(String)",
  "Timestamp": "2026-08-01T16:32:12.9121755Z",
  "Type": "User"
}

Detection Patterns #

Lateral Movement: Distributed Component Object Model

Defender-DeviceLogonEvents LogonSuccess: Logon succeededORDefender-IdentityInfo any: Identity information

1 rule

Kusto

Detect service account login on new device (source)

Robbe Van den Daele

Persistence: Account Manipulation

Defender-DeviceEvents UserAccountAddedToLocalGroup: User account added to local groupORUserAccountCreated: User account createdORUserAccountModified: User account modifiedORDefender-IdentityInfo any: Identity information

1 rule

Kusto

Local Admin Group Changes (source)

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`Type` (kusto rule field)	eq	`account`	5 rules	kusto
`Type` (kusto rule field)	eq	`ip`	4 rules	kusto
`ActivityType` (kusto rule field)	in	`FailedLogOn`	3 rules	kusto
`ActivityType` (kusto rule field)	in	`LogOn`	3 rules	kusto
`Category` (kusto rule field)	eq	`usermanagement`	3 rules	kusto
`EntityIp` (kusto rule field)	is_not_null		3 rules	kusto
`ProductName` (kusto rule field)	in	`Azure Active Directory Identity Protection`	3 rules	kusto
`ProductName` (kusto rule field)	in	`Microsoft Cloud App Security`	3 rules	kusto
`ProductName` (kusto rule field)	in	`Azure Active Directory`	2 rules	kusto
`ProductName` (kusto rule field)	in	`Microsoft 365 Defender`	2 rules	kusto
`ProductName` (kusto rule field)	in	`Microsoft Defender ATP`	2 rules	kusto
`SourceIPAddress` (kusto rule field)	is_not_null		3 rules	kusto
`AccountDisplayName` (kusto rule field)	is_not_null		2 rules	kusto
`AccountObjectId` (kusto rule field)	is_not_null		2 rules	kusto
`ActionType` (kusto rule field)	eq	`Success`	2 rules	kusto

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

Addition of a Temporary Access Pass to a Privileged Account source high: Detects when a Temporary Access Pass (TAP) is created for a Privileged Account. A Temporary Access Pass is a time-limited passcode issued by an admin that satisfies strong authentication requirements and can be used to onboard other authentication methods, including Passwordless ones such as Microsoft Authenticator or even Windows Hello. A threat actor could use a TAP to register a new authentication method to maintain persistance to an account. Review any TAP creations to ensure they were used legitimately. Ref: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-privileged-accounts#changes-to-privileged-accountsT1078, T1078.004
Suspicious modification of Global Administrator user properties source medium: This query will detect if user properties of Global Administrator are updated by an existing user. Usually only user administrator or other global administrator can update such properties. Investigate if such user change is an attempt to elevate an existing low privileged identity or rogue administrator activityT1078, T1078.004
Suspicious VM Instance Creation Activity Detected source medium: This detection identifies high-severity alerts across various Microsoft security products, including Microsoft Defender XDR and Microsoft Entra ID, and correlates them with instances of Google Cloud VM creation. It focuses on instances where VMs were created within a short timeframe of high-severity alerts, potentially indicating suspicious activity.T1078, T1106, T1526

Show 17 more (21 total) on the rules page

References #

Microsoft Defender XDR: advanced hunting reference