Azure AD STS logon events

Operation	Description	Sample	Rule
PasswordLogonInitialAuthUsingPassword	A user authenticated to Azure AD STS using a password as the initial credential, before any MFA step.	N	Y
UserLoggedIn	A user account authenticated against the Microsoft Entra ID Secure Token Service (STS). The schema defines RecordType 15 as STS logon events without restricting them to interactive sign-ins, so do not read this event as covering interactive logons only; a successful UserLoggedIn record also does not by itself mean the user went on to access any resource. First-party capture confirms it logs under AzureActiveDirectoryStsLogon (RecordType 15), not AzureActiveDirectory (RecordType 8).	Y	Y
UserLoginFailed	A user sign-in attempt failed; first-party capture confirms it logs under AzureActiveDirectoryStsLogon (RecordType 15), not AzureActiveDirectory (RecordType 8).	Y	Y

PasswordLogonInitialAuthUsingPassword

RecordType: AzureActiveDirectoryStsLogon

Description

A user authenticated to Azure AD STS using a password as the initial credential, before any MFA step.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete schema for this catalog entry.

Name	Rules	Vendors
`event.action`	2 detection rules	Elastic
`event.category`	2 detection rules	Elastic
`event.provider`	2 detection rules	Elastic
`Target.Type`	2 detection rules	Elastic
`LogonError`	1 detection rule	Elastic
`source.as.organization.name`	1 detection rule	Elastic

Common Indicators #

Positive field/value combinations most frequently checked by detection rules attached to this catalog entry, derived from cross-vendor predicate analysis. This is separate from Fields accounting, which also includes exclusions and counts distinct attached rules.

Field	Kind	Value	Rules	Vendors
`m365::Target.Type` (elastic rule field)	in	`0`	2 rules	elastic
`m365::Target.Type` (elastic rule field)	in	`10`	2 rules	elastic
`m365::Target.Type` (elastic rule field)	in	`2`	2 rules	elastic
`m365::Target.Type` (elastic rule field)	in	`6`	2 rules	elastic
`Esql.event_count` (elastic rule field)	ge	`10`	1 rule	elastic

Detection Rules #

Full rule details for this catalog entry, including ATT&CK technique mappings and native queries →

Elastic #

M365 Identity User Brute Force Attempted source medium: Identifies brute-force authentication activity targeting Microsoft 365 user accounts using failed sign-in patterns that match password spraying, credential stuffing, or password guessing behavior. Adversaries may attempt brute-force authentication with credentials obtained from previous breaches, leaks, marketplaces or guessable passwords.T1110, T1110.001, T1110.003, T1110.004↳ also matches UserLoginFailed
M365 Identity User Account Lockouts source medium: Detects a burst of Microsoft 365 user account lockouts within a short 5-minute window. A high number of IdsLocked login errors across multiple user accounts may indicate brute-force attempts for the same users resulting in lockouts.T1078, T1078.004, T1110, T1110.001, T1110.003, T1110.004↳ also matches UserLoginFailed

UserLoggedIn

RecordType: AzureActiveDirectoryStsLogon

Description

A user account authenticated against the Microsoft Entra ID Secure Token Service (STS). The schema defines RecordType 15 as STS logon events without restricting them to interactive sign-ins, so do not read this event as covering interactive logons only; a successful UserLoggedIn record also does not by itself mean the user went on to access any resource. First-party capture confirms it logs under AzureActiveDirectoryStsLogon (RecordType 15), not AzureActiveDirectory (RecordType 8).

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete schema for this catalog entry.

Name	Rules	Vendors
`event.action`	7 detection rules	Elastic
`security_result.action`	6 detection rules	YARA-L
`ApplicationId`	5 detection rules	Elastic
`target.resource.product_object_id`	5 detection rules	YARA-L
`ExtendedProperties.RequestType`	4 detection rules	Elastic
`Operation`	4 detection rules	Sigma, Splunk
`event.outcome`	3 detection rules	Elastic
`user_agent.original`	3 detection rules	Elastic
`UserId`	3 detection rules	Elastic
`UserType`	3 detection rules	Elastic
`event.provider`	2 detection rules	Elastic
`ExtendedProperties.ResultStatusDetail`	2 detection rules	Elastic
`ObjectId`	2 detection rules	Elastic
`source.geo.country_name`	2 detection rules	Elastic
`Target.Type`	2 detection rules	Elastic
`Workload`	2 detection rules	Splunk
`ApplicationId`	1 detection rule	Sigma
`event.category`	1 detection rule	Elastic
`network.http.user_agent`	1 detection rule	YARA-L
`network.session_id`	1 detection rule	YARA-L
`o365.audit.Target.ID`	1 detection rule	Elastic
`ObjectId`	1 detection rule	Sigma
`RequestType`	1 detection rule	Sigma
`ResultStatus`	1 detection rule	Sigma
`source.geo.region_name`	1 detection rule	Elastic
`source.ip`	1 detection rule	Elastic
`target.application`	1 detection rule	YARA-L
`target.user.userid`	1 detection rule	YARA-L

Example Audit Record #

{
  "Actor": [
    {
      "ID": "11111111-1111-1111-1111-111111111111",
      "Type": 0
    },
    {
      "ID": "adminuser@example.onmicrosoft.com",
      "Type": 5
    }
  ],
  "ActorContextId": "00000000-0000-0000-0000-000000000001",
  "ActorIpAddress": "203.0.113.10",
  "ApplicationId": "fb78d390-0c51-40cd-8e17-fdbfab77341b",
  "AzureActiveDirectoryEventType": 1,
  "ClientIP": "203.0.113.10",
  "CreationTime": "2026-07-02T15:29:47Z",
  "DeviceProperties": [
    {
      "Name": "OS",
      "Value": "Linux"
    },
    {
      "Name": "BrowserType",
      "Value": "Firefox"
    },
    {
      "Name": "IsCompliant",
      "Value": "False"
    },
    {
      "Name": "IsCompliantAndManaged",
      "Value": "False"
    },
    {
      "Name": "SessionId",
      "Value": "0022840a-e4ab-884c-587f-d20d24637227"
    }
  ],
  "ErrorNumber": "0",
  "ExtendedProperties": [
    {
      "Name": "ResultStatusDetail",
      "Value": "Success"
    },
    {
      "Name": "UserAgent",
      "Value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:152.0) Gecko/20100101 Firefox/152.0"
    },
    {
      "Name": "RequestType",
      "Value": "Cmsi:Cmsi"
    }
  ],
  "Id": "c9b63ef0-aa6e-4042-886d-75a46ac31000",
  "InterSystemsId": "fe1336ca-2296-44cf-9fd2-e4f912dc1aa1",
  "IntraSystemId": "c9b63ef0-aa6e-4042-886d-75a46ac31000",
  "ObjectId": "00000002-0000-0ff1-ce00-000000000000",
  "Operation": "UserLoggedIn",
  "OrganizationId": "00000000-0000-0000-0000-000000000001",
  "RecordType": 15,
  "ResultStatus": "Success",
  "Target": [
    {
      "ID": "00000002-0000-0ff1-ce00-000000000000",
      "Type": 0
    }
  ],
  "TargetContextId": "00000000-0000-0000-0000-000000000001",
  "UserId": "adminuser@example.onmicrosoft.com",
  "UserKey": "11111111-1111-1111-1111-111111111111",
  "UserType": 0,
  "Version": 1,
  "Workload": "AzureActiveDirectory"
}

Common Indicators #

Field	Kind	Value	Rules	Vendors
`security_result.action (Chronicle)`	eq	`ALLOW`	6 rules	chronicle
`m365::UserId` (elastic rule field)	is_not_null		3 rules	elastic
`target.resource.product_object_id (Chronicle)`	eq	`1b730954-1685-4b74-9bfd-dac224a7b894`	3 rules	chronicle
`m365::ApplicationId` (elastic rule field)	is_not_null		2 rules	elastic
`m365::Target.Type` (elastic rule field)	in	`0`	2 rules	elastic
`m365::Target.Type` (elastic rule field)	in	`10`	2 rules	elastic
`m365::Target.Type` (elastic rule field)	in	`2`	2 rules	elastic
`m365::Target.Type` (elastic rule field)	in	`3`	2 rules	elastic
`m365::Target.Type` (elastic rule field)	in	`5`	2 rules	elastic
`m365::Target.Type` (elastic rule field)	in	`6`	2 rules	elastic
`source.geo.country_name` (elastic rule field)	is_not_null		2 rules	elastic
`Esql.source_ip_count_distinct` (elastic rule field)	ge	`2`	1 rule	elastic
`ResultStatus` (sigma rule field)	eq	`Success`	1 rule	sigma
`TargetUserName` (chronicle rule field)	macro	re.replace($login.target.user.userid, `@.*$`, "")	1 rule	chronicle
`aws::userAgent` (elastic rule field)	eq	`BAV2ROPC`	1 rule	elastic

Detection Rules #

Full rule details for this catalog entry, including ATT&CK technique mappings and native queries →

Sigma #

Azure Login Bypassing Conditional Access Policies source high: Detects a successful login to the Microsoft Intune Company Portal which could allow bypassing Conditional Access Policies and InTune device trust using a tool like TokenSmith.T1078

Elastic #

M365 Identity OAuth Flow by First-Party Microsoft App from Multiple IPs source high: Identifies sign-ins on behalf of a principal user to the Microsoft Graph or legacy Azure AD API from multiple IPs using first-party Microsoft applications from the FOCI (Family of Client IDs) group. Developer tools like Azure CLI, VSCode, and Azure PowerShell accessing these resources from multiple IPs are flagged, along with any FOCI application accessing the deprecated Windows Azure Active Directory from multiple IPs. This behavior may indicate an adversary using a phished OAuth authorization code or refresh token, as seen in attacks like ConsentFix where attackers steal localhost OAuth codes and replay them from attacker infrastructure.T1078, T1078.004, T1528, T1550, T1550.001, T1566
M365 Identity Login from Atypical Region source medium: Detects successful Microsoft 365 portal logins from a country and region the user has not previously authenticated from in a specific time window. Atypical regions are identified by combining the user's country and region geolocation history; an authentication from a new country/region pair for that user may indicate an adversary attempting to access the account from an unusual location or behind a VPN.T1078, T1078.004
M365 Identity Login from Impossible Travel Location source medium: Detects successful Microsoft 365 portal logins from impossible travel locations. Impossible travel locations are defined as two different countries within a short time frame. This behavior may indicate an adversary attempting to access a Microsoft 365 account from a compromised account or a malicious actor attempting to access a Microsoft 365 account from a different location.T1078, T1078.004

Show 4 more (7 total) on the rules page

Splunk #

O365 Concurrent Sessions From Different Ips source: The following analytic identifies user sessions in Office 365 accessed from multiple IP addresses, indicating potential adversary-in-the-middle (AiTM) phishing attacks. It detects this activity by analyzing Azure Active Directory logs for…T1185
O365 Multiple AppIDs and UserAgents Authentication Spike source: The following analytic identifies unusual authentication activity in an O365 environment, where a single user account experiences more than 8 authentication attempts using 3 or more unique application IDs and over 5 unique user agents…T1078↳ also matches UserLoginFailed
O365 Multiple OS Vendors Authenticating From User source: The following analytic identifies when multiple operating systems are used to authenticate to Azure/EntraID/Office 365 by the same user account over a short period of time. This activity could be indicative of attackers enumerating various…T1110↳ also matches UserLoginFailed

YARA-L #

O365 Admin Login Activity To Uncommon Microsoft Cloud Apps source high: This rule detects O365 login activity to apps other than a defined list of first party MS Cloud Apps. Note that Azure Active Directory PowerShell and custom Azure apps are not in this list by defaultT1078, T1078.004
O365 Login Activity To Azure AD PowerShell App source medium: Logins to Azure AD PowerShell app can have legitimate purposes, but are also abused to gain access to user information. Programmatic access to Entra ID (Azure AD) should generally be through apps, so reviewing these activities is needed.T1078, T1078.004
O365 Login Activity To Uncommon Microsoft Cloud Apps source medium: This rule detects O365 login activity to apps other than a defined list of first party MS Cloud Apps. Note that Azure Active Directory PowerShell and custom Azure apps are not in this list by defaultT1078, T1078.004

Show 3 more (6 total) on the rules page

UserLoginFailed

RecordType: AzureActiveDirectoryStsLogon

Description

A user sign-in attempt failed; first-party capture confirms it logs under AzureActiveDirectoryStsLogon (RecordType 15), not AzureActiveDirectory (RecordType 8).

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete schema for this catalog entry.

Name	Rules	Vendors
`Operation`	9 detection rules	Panther, Splunk
`Workload`	7 detection rules	Splunk
`ErrorNumber`	3 detection rules	Splunk
`event.action`	2 detection rules	Elastic
`event.category`	2 detection rules	Elastic
`event.provider`	2 detection rules	Elastic
`record_type`	2 detection rules	Splunk
`Target.Type`	2 detection rules	Elastic
`LogonError`	1 detection rule	Splunk
`LogonError`	1 detection rule	Elastic
`ResultStatus`	1 detection rule	Splunk
`source.as.organization.name`	1 detection rule	Elastic

Example Audit Record #

{
  "Actor": [
    {
      "ID": "11111111-1111-1111-1111-111111111111",
      "Type": 0
    },
    {
      "ID": "adminuser@example.onmicrosoft.com",
      "Type": 5
    }
  ],
  "ActorContextId": "00000000-0000-0000-0000-000000000001",
  "ActorIpAddress": "203.0.113.10",
  "ApplicationId": "12128f48-ec9e-42f0-b203-ea49fb6af367",
  "AzureActiveDirectoryEventType": 1,
  "ClientIP": "203.0.113.10",
  "CreationTime": "2026-07-02T15:44:44Z",
  "DeviceProperties": [
    {
      "Name": "OS",
      "Value": "Linux"
    },
    {
      "Name": "BrowserType",
      "Value": "Firefox"
    },
    {
      "Name": "IsCompliant",
      "Value": "False"
    },
    {
      "Name": "IsCompliantAndManaged",
      "Value": "False"
    },
    {
      "Name": "SessionId",
      "Value": "0022840a-e4ab-884c-587f-d20d24637227"
    }
  ],
  "ErrorNumber": "50199",
  "ExtendedProperties": [
    {
      "Name": "ResultStatusDetail",
      "Value": "Success"
    },
    {
      "Name": "UserAgent",
      "Value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:152.0) Gecko/20100101 Firefox/152.0"
    },
    {
      "Name": "RequestType",
      "Value": "Login:reprocess"
    }
  ],
  "Id": "c2d3606b-8392-481a-a571-d3a63f701000",
  "InterSystemsId": "3e459115-c228-4fd9-aa4a-b8af7572a0e0",
  "IntraSystemId": "c2d3606b-8392-481a-a571-d3a63f701000",
  "LogonError": "CmsiInterrupt",
  "ObjectId": "00000003-0000-0000-c000-000000000000",
  "Operation": "UserLoginFailed",
  "OrganizationId": "00000000-0000-0000-0000-000000000001",
  "RecordType": 15,
  "ResultStatus": "Success",
  "Target": [
    {
      "ID": "00000003-0000-0000-c000-000000000000",
      "Type": 0
    }
  ],
  "TargetContextId": "00000000-0000-0000-0000-000000000001",
  "UserId": "adminuser@example.onmicrosoft.com",
  "UserKey": "11111111-1111-1111-1111-111111111111",
  "UserType": 0,
  "Version": 1,
  "Workload": "AzureActiveDirectory"
}

Common Indicators #

Field	Kind	Value	Rules	Vendors
`ErrorNumber` (splunk rule field)	eq	`50126`	2 rules	splunk
`failed_attempts` (splunk rule field)	gt	`10`	2 rules	splunk
`m365::Target.Type` (elastic rule field)	in	`0`	2 rules	elastic
`m365::Target.Type` (elastic rule field)	in	`10`	2 rules	elastic
`m365::Target.Type` (elastic rule field)	in	`2`	2 rules	elastic
`m365::Target.Type` (elastic rule field)	in	`6`	2 rules	elastic
`Esql.event_count` (elastic rule field)	ge	`10`	1 rule	elastic
`ResultStatus` (splunk rule field)	eq	`Success`	1 rule	splunk
`count` (splunk rule field)	ge	`5`	1 rule	splunk
`uniqueIPs` (splunk rule field)	gt	`20`	1 rule	splunk
`uniqueIpUserCombinations` (splunk rule field)	gt	`20`	1 rule	splunk
`uniqueUsers` (splunk rule field)	gt	`20`	1 rule	splunk
`unique_app_ids` (splunk rule field)	gt	`2`	1 rule	splunk
`unique_user_agents` (splunk rule field)	gt	`5`	1 rule	splunk

Detection Rules #

Full rule details for this catalog entry, including ATT&CK technique mappings and native queries →

Elastic #

M365 Identity User Brute Force Attempted source medium: Identifies brute-force authentication activity targeting Microsoft 365 user accounts using failed sign-in patterns that match password spraying, credential stuffing, or password guessing behavior. Adversaries may attempt brute-force authentication with credentials obtained from previous breaches, leaks, marketplaces or guessable passwords.T1110, T1110.001, T1110.003, T1110.004↳ also matches PasswordLogonInitialAuthUsingPassword
M365 Identity User Account Lockouts source medium: Detects a burst of Microsoft 365 user account lockouts within a short 5-minute window. A high number of IdsLocked login errors across multiple user accounts may indicate brute-force attempts for the same users resulting in lockouts.T1078, T1078.004, T1110, T1110.001, T1110.003, T1110.004↳ also matches PasswordLogonInitialAuthUsingPassword

Splunk #

High Number of Login Failures from a single source source: The following analytic detects multiple failed login attempts in Office365 Azure Active Directory from a single source IP address. It leverages Office365 management activity logs, specifically AzureActiveDirectoryStsLogon records,…T1110, T1110.001
O365 Excessive SSO logon errors source: The following analytic detects accounts experiencing a high number of Single Sign-On (SSO) logon errors. It leverages data from the o365_management_activity dataset, focusing on failed user login attempts with SSO errors. This activity…T1556
O365 High Number Of Failed Authentications for User source: The following analytic identifies an O365 account experiencing more than 20 failed authentication attempts within 5 minutes. It uses O365 Unified Audit Logs, specifically "UserLoginFailed" events, to monitor and flag accounts exceeding…T1110, T1110.001

Show 5 more (8 total) on the rules page

Panther #

Microsoft365 Brute Force Login by User source medium: A Microsoft365 user was denied login access several timesT1110

any: Azure AD STS logon events (catch-all)

Scope grouping: This repository-authored catalog entry represents a broad attribution scope, not a distinct emitted event or operation. Any sample below is a representative record from that scope; attached rules, if any, are listed separately.

RecordType: AzureActiveDirectoryStsLogon

Description

Catch-all for M365-AzureActiveDirectoryStsLogon rules matching the RecordType but no specific Operation.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete schema for this catalog entry.

Name	Rules	Vendors
`RecordType`	1 detection rule	Kusto

Common Indicators #

Field	Kind	Value	Rules	Vendors
`csUserAgent` (kusto rule field)	is_not_null		1 rule	kusto

Detection Rules #

Full rule details for this catalog entry, including ATT&CK technique mappings and native queries →

Kusto #

Malformed user agent source medium: Malware authors will sometimes hardcode user agent string values when writing the network communication component of their malware. Malformed user agents can be an indication of such malware.T1071, T1189, T1203

References #

M365 audit records use different field names on each surface #

The same Unified Audit Log record uses different field names on each surface. A query built for one surface can silently miss on another. These pages document the Management Activity API JSON names, the same names Search-UnifiedAuditLog and the Office 365 Management Activity API return.

Purview CSV export flattens each record to four columns (CreationDate, UserIds, Operations, AuditData). The API field names live only inside the AuditData JSON blob. Expand it with ConvertFrom-Json. The wrapper columns are renamed too: CreationDate not CreationTime, UserIds not UserId, Operations not Operation.
Sentinel's OfficeActivity table renames several fields and turns two integer enum columns into strings. The table below maps them.

API JSON (event pages)	OfficeActivity column	Note
`Id`	`OfficeId`	Renamed.
`Workload`	`OfficeWorkload`	Renamed.
`ObjectId`	`OfficeObjectId`	Renamed.
`CreationTime`	`TimeGenerated`	Renamed. OfficeActivity has no `CreationTime` column.
`SiteUrl`	`Site_Url`	Renamed (SharePoint family).
`RecordType`	`RecordType`	Same name; the Int32 enum becomes its string enum name.
`UserType`	`UserType`	Same name; the Int32 enum becomes a string.
`ClientIP`	`ClientIP`, `Client_IPAddress`	Both columns present on OfficeActivity.
`Scope`	(none)	No OfficeActivity equivalent under any name. Recover it from the API JSON or the Purview `AuditData` blob.
`Operation`, `UserId`, `ResultStatus`, `UserKey`, `AppAccessContext`, `OrganizationId`	same names	Unchanged. No `_s` / `_d` suffixes (a native table, not a custom log).

Mapping verified against the OfficeActivity table reference, the Management Activity API schema, and the Purview audit-record export format.

Azure AD STS logon events

PasswordLogonInitialAuthUsingPassword

Description

Detection Fields #

Common Indicators #

Related events #

Detection Rules #

Elastic #

UserLoggedIn

Description

Detection Fields #

Example Audit Record #

Common Indicators #

Related events #

Detection Rules #

Sigma #

Elastic #

Splunk #

YARA-L #

UserLoginFailed

Description

Detection Fields #

Example Audit Record #

Common Indicators #

Related events #

Detection Rules #

Elastic #

Splunk #

Panther #

any: Azure AD STS logon events (catch-all)

Description

Detection Fields #

Common Indicators #

Related events #

Detection Rules #

Kusto #

References #