detection.wiki

Azure AD Identity Protection risk detections M365-AadRiskDetection

1 operation, identified by Operation in the audit log.

OperationDescription
_catch_allCatch-all for M365-AadRiskDetection rules matching the RecordType but no specific Operation.

_catch_all: Azure AD Identity Protection risk detections (catch-all)

#
RecordType
M365-AadRiskDetection

Description

Catch-all for M365-AadRiskDetection rules matching the RecordType but no specific Operation.

Fields #

NameDescription
RecordTypeAuditLogRecordType enum value (named string in Sentinel OfficeActivity; integer in the raw Management Activity API JSON).
OperationThe name of the user or admin activity. For Exchange admin activity this is the cmdlet name; for DLP it is DlpRuleMatch/DlpRuleUndo/DlpInfo. The per-event discriminator (event.action in Elastic ECS).
WorkloadThe Microsoft 365 service where the activity occurred (Exchange, SharePoint, AzureActiveDirectory, MicrosoftTeams, ...). Surfaces as event.provider in Elastic ECS.
ResultStatusWhether the action succeeded: Succeeded, PartiallySucceeded, or Failed (True/False for Exchange admin). For STS-logon events this reflects only the HTTP operation, not logon success: check LogonError.
UserIdUPN of the user who performed the action; system-account and app@sharepoint values also appear.
UserTypeType of actor: Regular, Admin, System, DcAdmin, Application, ServicePrincipal.
UserKeyAlternative ID for the user (the PUID for SharePoint / OneDrive / Exchange events).
ClientIPIPv4/IPv6 address of the device used; may be a trusted-app IP, and is null for Microsoft Entra ID events.
ObjectIdFor SharePoint/OneDrive, the full path of the file/folder; for Exchange admin, the object modified by the cmdlet; shape is operation-specific.
OrganizationIdGUID of the tenant's Office 365 organization (constant per tenant).
IdUnique identifier (GUID) for the audit record.
CreationTimeUTC date/time when the audit record was generated.
ScopeSource of the event: online (a Microsoft 365 service) or onprem (an on-premises service; currently SharePoint only).
AppAccessContextApplication context for the user or service principal that performed the action.

Detection Rules #

View all rules referencing this event →

Elastic #

  • M365 Entra ID Risk Detection Signal source low: Identifies Microsoft Entra ID (formerly Azure AD) risk detection signals including risky sign-ins, compromised credentials, impossible travel, and other identity-based anomalies. These events indicate potential credential compromise, account takeover attempts, or suspicious authentication patterns detected by Microsoft's identity protection. This building block rule generates security events for correlation, threat hunting, and telemetry collection to support detection of credential access and initial access attempts.

References #