Detection rules › By event

Entra-AuditLogs

Event	Rules
any	59
Add app role assignment to service principal	10
Add application	1
Add conditional access policy	2
Add delegated permission grant	7
Add device	3
Add eligible member (eligible)	2
Add eligible member (permanent)	2
Add eligible member to role	3
Add eligible member to role in PIM completed (permanent)	1
Add member to group	2
Add member to role	16
Add member to role completed (PIM activation)	2
Add member to role in PIM completed (timebound)	1
Add member to role in PIM requested (permanent)	1
Add member to role outside of PIM (permanent)	1
Add member to role request denied (PIM activation)	3
Add named location	1
Add OAuth2PermissionGrant	3
Add owner to application	4
Add owner to group	1
Add owner to service principal	1
Add registered owner to device	1
Add registered users to device	1
Add service principal	9
Add service principal credentials	2
Add unverified domain	4
Add user	7
Add verified domain	1
Admin deleted security info	4
Admin registered security info	7
Admin updated security info	4
Assigns the caller to user access admin	1
Authentication Methods Policy Update	1
Bulk invite users - started (bulk)	1
Consent to application	9
Delete application	2
Delete conditional access policy	3
Delete device	1
Delete group	1
Delete user	4
Disable Strong Authentication	4
Enable account	1
Hard Delete application	2
Invite external user	8
Invite external user with reset invitation status	1
Read BitLocker key	1
Redeem external user invite	1
Register device	4
Remove member from group	2
Remove service principal	2
Restore application	1
Set Company Information	1
Set device registration policies	1
Set domain authentication	5
Set federation settings on domain	5
Suspicious activity reported	1
Update application	9
Update application – Certificates and secrets management	2
Update conditional access policy	10
Update device	2
Update group	1
Update named location	1
Update role setting in PIM	3
Update user	10
Update User Risk and MFA Registration Policy	1
User changed default security info	4
User deleted security info	5
User has elevated their access to User Access Administrator for their Azure Resources	2
User registered security info	8
User reviewed security info	2
Verify domain	1
Add eligible member to role in PIM requested (timebound)	1
Add scoped member to role	1
Delete administrative unit	1
Delete device configuration	1
Device no longer compliant	1
Device no longer managed	1
Disable PIM alert	1
Remove owner from application	1
Remove owner from service principal	1
Reset password (by admin)	1
Update authorization policy	1
Update device configuration	1
Update service principal	1
User registered all required security info	1
User started security info registration	1
Create Temporary Access Pass method for user	1

any

59 detection rules reference this event. View event page.

Sigma (10)

Application URI Configuration Changes severity high T1078, T1078.004, T1528
Bulk Deletion Changes To Privileged Account Permissions severity high T1098
End User Consent severity low T1528
End User Consent Blocked severity medium T1528
Password Reset By User Account severity medium T1078, T1078.004
PIM Approvals And Deny Elevation severity high T1078, T1078.004
Privileged Account Creation severity medium T1078, T1078.004
User Added To Group With CA Policy Modification Access severity medium T1548, T1556
Users Added to Global or Device Admin Roles severity high T1078, T1078.004
Windows LAPS Credential Dump From Entra ID severity high T1098, T1098.005

Elastic (3)

Entra ID Actor Token User Impersonation Abuse severity medium T1078, T1078.004, T1548, T1550, T1550.001
Entra ID Kali365 Default User-Agent Detected severity high T1078, T1078.004, T1528, T1550, T1550.001, T1566
Entra ID Sign-in BloodHound Suite User-Agent Detected severity high T1069, T1069.003, T1082, T1087, T1087.004, T1201

Splunk (2)

Azure AD PIM Role Assigned severity medium T1098, T1098.003
Azure AD Service Principal New Client Credentials severity medium T1098, T1098.001

Kusto (36)

[Entra ID] Mass Privileged Role Change Activity Detected severity high T1078
[Entra ID] Privileged Role Assigned to a New User severity high T1078, T1078.004
[Entra ID] Privileged Role Assigned to User severity high T1078, T1078.004
Application ID URI Changed severity medium T1078, T1078.004
Bulk Changes to Privileged Account Permissions severity high T1078, T1078.004
Changes to Application Logout URL severity low T1078, T1078.004
Conditional Access Policy Modified by New User severity medium T1078, T1078.004
Cross-tenant Access Settings Organization Added severity medium T1078, T1078.004, T1087, T1087.004, T1136, T1136.003
Cross-tenant Access Settings Organization Deleted severity medium T1078, T1078.004, T1087, T1087.004, T1136, T1136.003
Cross-tenant Access Settings Organization Inbound Collaboration Settings Changed severity medium T1078, T1078.004, T1087, T1087.004, T1136, T1136.003
Cross-tenant Access Settings Organization Inbound Direct Settings Changed severity medium T1078, T1078.004, T1087, T1087.004, T1136, T1136.003
Cross-tenant Access Settings Organization Outbound Collaboration Settings Changed severity medium T1078, T1078.004, T1087, T1087.004, T1136, T1136.003
Cross-tenant Access Settings Organization Outbound Direct Settings Changed severity medium T1078, T1078.004, T1087, T1087.004, T1136, T1136.003
Detect changes to Connect Sync Application T1078, T1078.004, T1098, T1556, T1556.007
Detect credential add to Connect Sync Application T1078, T1078.004, T1098, T1098.001, T1556, T1556.007
Detect PIM Alert Disabling activity severity medium T1078, T1098
Detect PIM elevation with user risk T1548
End-user consent stopped due to risk-based consent severity medium T1078, T1078.004
First access credential added to Application or Service Principal where no credential was present severity high T1550, T1550.001
Mail.Read Permissions Granted to Application severity medium T1098
Malformed user agent severity medium T1071, T1189, T1203
Multiple admin membership removals from newly created admin. severity medium T1531
Multiple Password Reset by user severity low T1078, T1110
New access credential added to Application or Service Principal severity medium T1550, T1550.001
New User Assigned to Privileged Role severity high T1078, T1078.004
NRT First access credential added to Application or Service Principal where no credential was present severity medium T1550, T1550.001
NRT New access credential added to Application or Service Principal severity medium T1550
Power Platform - Account added to privileged Microsoft Entra roles severity low T1068, T1078, T1548
Privileged Account Permissions Changed severity medium T1078, T1078.004
Rare application consent severity medium T1068, T1136
Service Principal Assigned Privileged Role severity medium T1078, T1078.004
Threat Essentials - Multiple admin membership removals from newly created admin. severity medium T1531
Threat Essentials - User Assigned Privileged Role severity high T1078, T1078.004
TI Map URL Entity to AuditLogs severity medium T1071
TI Map URL Entity to AuditLogs severity medium T1071
User Assigned New Privileged Role severity high T1078, T1078.004

YARA-L (1)

Client Secret Added to Entra ID Application severity medium T1098, T1098.001

Panther (7)

Azure Authentication Methods Policy OIDC Discovery URL Changed severity high T1556, T1556.009
Azure Domain Federation Settings Modified severity medium T1556, T1556.006
Azure Policy Changed severity low T1526
Azure Role Changed PIM severity medium T1586
Azure Service Principal Credentials Added severity medium T1098, T1098.001
Azure User Elevated to User Access Administrator Role severity high T1098, T1098.003
Microsoft Entra ID Anomalous Application Consent

Add app role assignment to service principal

10 detection rules reference this event. View event page.

Sigma (2)

App Granted Microsoft Permissions severity high T1528
App Granted Privileged Delegated Or App Permissions severity high T1098, T1098.003

Splunk (2)

Azure AD Admin Consent Bypassed by Service Principal severity medium T1098, T1098.003
Azure AD Service Principal Privilege Escalation severity medium T1098, T1098.003

Add application

1 detection rules reference this event. View event page.

YARA-L (1)

Entra ID Application Creation severity low

Add conditional access policy

2 detection rules reference this event. View event page.

Sigma (1)

New CA Policy by Non-approved Actor severity medium T1548

Kusto (1)

Conditional Access - A new Conditional Access policy was created severity informational T1685, T1686.001

Add delegated permission grant

7 detection rules reference this event. View event page.

Sigma (2)

App Granted Microsoft Permissions severity high T1528
Delegated Permissions Granted For All Users severity high T1528

Kusto (5)

[Entra ID] Application Granted Administrative Permission to Assign Microsoft Entra ID Roles severity high T1098, T1098.003
Microsoft Entra ID Role Management Permission Grant severity high T1078, T1078.004, T1098, T1098.003
Suspicious application consent for offline access severity low T1528
Suspicious application consent similar to O365 Attack Toolkit severity high T1528, T1550
Suspicious application consent similar to PwnAuth severity medium T1528, T1550

Add device

3 detection rules reference this event. View event page.

Elastic (3)

Entra ID Device Registration with Phishing Kit Default OS Build severity medium T1098, T1098.005
Entra ID Device Registration with ROADtools Default OS Build severity high T1098, T1098.005
Entra ID Unusual Cloud Device Registration severity medium T1098, T1098.005

Add eligible member (eligible)

2 detection rules reference this event. View event page.

Sigma (1)

User Added To Privilege Role severity high T1078, T1078.004

Kusto (1)

User Added to Admin Role severity low T1078, T1078.004

Add eligible member (permanent)

2 detection rules reference this event. View event page.

Sigma (1)

User Added To Privilege Role severity high T1078, T1078.004

Kusto (1)

User Added to Admin Role severity low T1078, T1078.004

Add eligible member to role

3 detection rules reference this event. View event page.

Sigma (1)

App Assigned To Azure RBAC/Microsoft Entra Role severity medium T1098, T1098.003

Kusto (2)

NRT User added to Microsoft Entra ID Privileged Groups severity medium T1078, T1098
User added to Microsoft Entra ID Privileged Groups severity medium T1078, T1098

Add eligible member to role in PIM completed (permanent)

1 detection rules reference this event. View event page.

Elastic (1)

Entra ID Global Administrator Role Assigned (PIM User) severity high T1098, T1098.003

Add member to group

2 detection rules reference this event. View event page.

Kusto (2)

Add member to role

16 detection rules reference this event. View event page.

Sigma (2)

App Assigned To Azure RBAC/Microsoft Entra Role severity medium T1098, T1098.003
User Added to an Administrator's Azure AD Role severity medium T1078, T1098, T1098.003

Elastic (1)

Entra ID Global Administrator Role Assigned severity high T1098, T1098.003

Splunk (5)

Azure AD Application Administrator Role Assigned severity medium T1098, T1098.003
Azure AD Global Administrator Role Assigned severity medium T1098, T1098.003
Azure AD Privileged Authentication Administrator Role Assigned severity medium T1003, T1003.002
Azure AD Privileged Role Assigned severity medium T1098, T1098.003
Azure AD Privileged Role Assigned to Service Principal severity medium T1098, T1098.003

Kusto (6)

NRT Privileged Role Assigned Outside PIM severity low T1078, T1078.004
NRT User added to Microsoft Entra ID Privileged Groups severity medium T1078, T1098
Privileged Role Assigned Outside PIM severity low T1078, T1078.004
Threat Essentials - NRT User added to Microsoft Entra ID Privileged Groups severity medium T1078, T1098
User Added to Admin Role severity low T1078, T1078.004
User added to Microsoft Entra ID Privileged Groups severity medium T1078, T1098

YARA-L (2)

Entra ID Add User To Admin Role severity medium T1098, T1098.003
Entra ID Recently Created User Assigned an Entra ID Role severity high T1098, T1098.003

Add member to role completed (PIM activation)

2 detection rules reference this event. View event page.

Splunk (1)

Azure AD PIM Role Assignment Activated severity medium T1098, T1098.003

Kusto (1)

Account Elevated to New Role severity medium T1078, T1078.004

Add member to role in PIM completed (timebound)

1 detection rules reference this event. View event page.

Elastic (1)

Entra ID Global Administrator Role Assigned (PIM User) severity high T1098, T1098.003

Add member to role in PIM requested (permanent)

1 detection rules reference this event. View event page.

Kusto (1)

Threat Essentials - NRT User added to Microsoft Entra ID Privileged Groups severity medium T1078, T1098

Add member to role outside of PIM (permanent)

1 detection rules reference this event. View event page.

YARA-L (1)

Entra ID Add User Outside PIM severity medium T1098, T1098.003

Add member to role request denied (PIM activation)

3 detection rules reference this event. View event page.

Kusto (3)

[Entra ID] Privilege Elevation Request Denied severity high T1078, T1078.004
NRT PIM Elevation Request Rejected severity high T1078, T1078.004
PIM Elevation Request Rejected severity high T1078, T1078.004

Add named location

1 detection rules reference this event. View event page.

Kusto (1)

Detect suspicious conditional access policy modifications T1556, T1556.009

Add OAuth2PermissionGrant

3 detection rules reference this event. View event page.

Kusto (3)

Suspicious application consent for offline access severity low T1528
Suspicious application consent similar to O365 Attack Toolkit severity high T1528, T1550
Suspicious application consent similar to PwnAuth severity medium T1528, T1550

Add owner to application

4 detection rules reference this event. View event page.

Sigma (1)

Added Owner To Application severity medium T1552

Elastic (1)

Entra ID User Added as Registered Application Owner severity low T1098, T1528

Splunk (1)

Azure AD Service Principal Owner Added severity medium T1098

Kusto (1)

Changes to Application Ownership severity medium T1078, T1078.004

Add owner to group

1 detection rules reference this event. View event page.

Kusto (1)

Guest accounts added in Entra ID Groups other than the ones specified severity high T1078, T1078.004, T1087, T1087.004, T1136, T1136.003

Add owner to service principal

1 detection rules reference this event. View event page.

Elastic (1)

Entra ID User Added as Service Principal Owner severity low T1078, T1078.004, T1098

Add registered owner to device

1 detection rules reference this event. View event page.

Elastic (1)

Entra ID Unusual Cloud Device Registration severity medium T1098, T1098.005

Add registered users to device

1 detection rules reference this event. View event page.

Elastic (1)

Entra ID Unusual Cloud Device Registration severity medium T1098, T1098.005

Add service principal

9 detection rules reference this event. View event page.

Sigma (1)

Azure Service Principal Created severity medium

Elastic (1)

Entra ID Service Principal Created severity low T1136, T1136.003

Splunk (3)

Azure AD Multiple Service Principals Created by SP severity low T1136, T1136.003
Azure AD Multiple Service Principals Created by User severity low T1136, T1136.003
Azure AD Service Principal Created severity medium T1136, T1136.003

Kusto (4)

Suspicious application consent for offline access severity low T1528
Suspicious application consent similar to O365 Attack Toolkit severity high T1528, T1550
Suspicious application consent similar to PwnAuth severity medium T1528, T1550
Suspicious Service Principal creation activity severity low T1078, T1528

Add service principal credentials

2 detection rules reference this event. View event page.

Elastic (1)

Entra ID Service Principal Credentials Created by Unusual User severity medium T1098, T1098.001

Kusto (1)

Credential added after admin consented to Application severity medium T1098, T1555

Add unverified domain

4 detection rules reference this event. View event page.

Elastic (1)

Entra ID Custom Domain Added or Verified severity low T1584, T1584.001

Splunk (1)

Azure AD New Custom Domain Added severity medium T1484, T1484.002

Kusto (2)

New onmicrosoft domain added to tenant severity medium T1585, T1585.003
Possible SignIn from Azure Backdoor severity medium T1098

Add user

7 detection rules reference this event. View event page.

Sigma (1)

Account Created And Deleted Within A Close Time Frame severity high T1078

Kusto (5)

Account Created and Deleted in Short Timeframe severity high T1078, T1078.004
Account created from non-approved sources severity medium T1136, T1136.003
Account created or deleted by non-approved user severity medium T1078, T1078.004
User Account Created Using Incorrect Naming Format severity low T1136, T1136.003
User account created without expected attributes defined severity low T1136, T1136.003

YARA-L (1)

Entra ID Recently Created User Assigned an Entra ID Role severity high T1098, T1098.003

Add verified domain

1 detection rules reference this event. View event page.

Kusto (1)

New onmicrosoft domain added to tenant severity medium T1585, T1585.003

Admin deleted security info

4 detection rules reference this event. View event page.

Kusto (4)

[Entra ID] Authentication Method Changed for Privileged Account severity high T1098
Authentication Methods Changed for Privileged Account severity high T1098
NRT Authentication Methods Changed for VIP Users severity medium T1098
Suspicious Sign In Followed by MFA Modification severity medium T1078, T1078.004, T1556, T1556.006

Admin registered security info

7 detection rules reference this event. View event page.

Sigma (1)

Temporary Access Pass Added To An Account severity high T1078, T1078.004

Elastic (1)

Entra ID Temporary Access Pass Created for User severity high T1078, T1078.004, T1550

Kusto (5)

[Entra ID] Authentication Method Changed for Privileged Account severity high T1098
Addition of a Temporary Access Pass to a Privileged Account severity high T1078, T1078.004
Authentication Methods Changed for Privileged Account severity high T1098
NRT Authentication Methods Changed for VIP Users severity medium T1098
Suspicious Sign In Followed by MFA Modification severity medium T1078, T1078.004, T1556, T1556.006

Admin updated security info

4 detection rules reference this event. View event page.

Kusto (4)

[Entra ID] Authentication Method Changed for Privileged Account severity high T1098
Authentication Methods Changed for Privileged Account severity high T1098
NRT Authentication Methods Changed for VIP Users severity medium T1098
Suspicious Sign In Followed by MFA Modification severity medium T1078, T1078.004, T1556, T1556.006

Assigns the caller to user access admin

1 detection rules reference this event. View event page.

Sigma (1)

Azure Subscription Permission Elevation Via AuditLogs severity high T1078

Authentication Methods Policy Update

1 detection rules reference this event. View event page.

Sigma (1)

Certificate-Based Authentication Enabled severity medium T1556

Bulk invite users - started (bulk)

1 detection rules reference this event. View event page.

Kusto (1)

External guest invitation followed by Microsoft Entra ID PowerShell signin severity medium T1078, T1078.004, T1087, T1087.004, T1136, T1136.003

Delete application

2 detection rules reference this event. View event page.

Sigma (1)

Azure Application Deleted severity medium T1489

YARA-L (1)

Entra ID Application Deletion severity medium

Delete conditional access policy

3 detection rules reference this event. View event page.

Sigma (1)

CA Policy Removed by Non Approved Actor severity medium T1548, T1556

Kusto (2)

Delete device

1 detection rules reference this event. View event page.

Sigma (1)

Azure Device or Configuration Modified or Deleted severity medium T1485, T1565, T1565.001

Delete group

1 detection rules reference this event. View event page.

YARA-L (1)

Entra ID Successful Group Deletion severity low

Delete user

4 detection rules reference this event. View event page.

Sigma (1)

Account Created And Deleted Within A Close Time Frame severity high T1078

Kusto (3)

Account Created and Deleted in Short Timeframe severity high T1078, T1078.004
Account created or deleted by non-approved user severity medium T1078, T1078.004
Suspicious Login from deleted guest account severity medium T1078, T1078.004

Disable Strong Authentication

4 detection rules reference this event. View event page.

Sigma (1)

Disabled MFA to Bypass Authentication Mechanisms severity medium T1556

Elastic (1)

Entra ID MFA Disabled for User severity medium T1556, T1556.006

Splunk (1)

Azure AD Multi-Factor Authentication Disabled severity medium T1556, T1556.006, T1586, T1586.003

Kusto (1)

Multi-Factor Authentication Disabled for a User severity medium T1098, T1556

Enable account

1 detection rules reference this event. View event page.

Splunk (1)

Azure AD User Enabled And Password Reset severity medium T1098

Hard Delete application

2 detection rules reference this event. View event page.

Sigma (1)

Azure Application Deleted severity medium T1489

YARA-L (1)

Entra ID Application Hard Deletion severity medium

Invite external user

8 detection rules reference this event. View event page.

Sigma (1)

Guest User Invited By Non Approved Inviters severity medium T1078, T1078.004

Elastic (1)

Entra ID External Guest User Invited severity low T1078, T1136, T1136.003

Splunk (1)

Azure AD External Guest User Invited severity medium T1136, T1136.003

Kusto (4)

External guest invitation followed by Microsoft Entra ID PowerShell signin severity medium T1078, T1078.004, T1087, T1087.004, T1136, T1136.003
Guest Users Invited to Tenant by New Inviters severity medium T1078, T1078.004
New External User Granted Admin Role severity medium T1098, T1098.001
Power Apps - Bulk sharing of Power Apps to newly created guest users severity medium T1534, T1566, T1587

Panther (1)

Azure Invite External Users severity low T1078

Invite external user with reset invitation status

1 detection rules reference this event. View event page.

Kusto (1)

External guest invitation followed by Microsoft Entra ID PowerShell signin severity medium T1078, T1078.004, T1087, T1087.004, T1136, T1136.003

Read BitLocker key

1 detection rules reference this event. View event page.

Sigma (1)

Bitlocker Key Retrieval severity medium T1078, T1078.004

Redeem external user invite

1 detection rules reference this event. View event page.

Kusto (1)

New External User Granted Admin Role severity medium T1098, T1098.001

Register device

4 detection rules reference this event. View event page.

Elastic (4)

Entra ID AiTM Phishing-Kit Chain Detected severity high T1078, T1078.004, T1098, T1098.005, T1528, T1550
Entra ID Multiple Device Registrations by a Single User severity medium T1078, T1078.004, T1098, T1098.005, T1557
Entra ID Protection User Alert and Device Registration severity high T1078, T1078.004, T1098, T1098.005
Entra ID Register Device with Unusual User Agent (Azure AD Join) severity medium T1098, T1098.005

Remove member from group

2 detection rules reference this event. View event page.

Sigma (1)

User Removed From Group With CA Policy Modification Access severity medium T1548, T1556

Kusto (1)

Detect suspicious conditional access policy modifications T1556, T1556.009

Remove service principal

2 detection rules reference this event. View event page.

Sigma (1)

Azure Service Principal Removed severity medium

Kusto (1)

Suspicious Service Principal creation activity severity low T1078, T1528

Restore application

1 detection rules reference this event. View event page.

YARA-L (1)

Entra ID Application Restore severity medium

Set Company Information

1 detection rules reference this event. View event page.

Sigma (1)

New Root Certificate Authority Added severity medium T1556

Set device registration policies

1 detection rules reference this event. View event page.

Sigma (1)

Changes to Device Registration Policy severity high T1484

Set domain authentication

5 detection rules reference this event. View event page.

Elastic (1)

Entra ID Domain Federation Configuration Change severity high T1098, T1098.001, T1484, T1484.002, T1556, T1556.007

Splunk (1)

Azure AD New Federated Domain Added severity medium T1484, T1484.002

Kusto (3)

[Entra ID] Domain Federation Trust Settings Modified severity high T1098, T1555
Modified domain federation trust settings severity high T1098, T1555
NRT Modified domain federation trust settings severity high T1098, T1555

Set federation settings on domain

5 detection rules reference this event. View event page.

Sigma (1)

Azure Domain Federation Settings Modified severity medium T1078

Elastic (1)

Entra ID Domain Federation Configuration Change severity high T1098, T1098.001, T1484, T1484.002, T1556, T1556.007

Kusto (3)

[Entra ID] Domain Federation Trust Settings Modified severity high T1098, T1555
Modified domain federation trust settings severity high T1098, T1555
NRT Modified domain federation trust settings severity high T1098, T1555

Suspicious activity reported

1 detection rules reference this event. View event page.

Elastic (1)

Entra ID User Reported Suspicious Activity severity medium T1078, T1078.004, T1621

Update application

9 detection rules reference this event. View event page.

Sigma (1)

Application AppID Uri Configuration Changes severity high T1078, T1078.004, T1552

Elastic (2)

Entra ID Federated Identity Credential Issuer Modified severity high T1098, T1098.001, T1484, T1484.002
Entra ID OAuth Application Redirect URI Modified severity high T1528, T1556

Splunk (2)

Azure AD FullAccessAsApp Permission Assigned severity medium T1098, T1098.002, T1098.003
Azure AD Privileged Graph API Permission Assigned severity medium T1003, T1003.002

Kusto (3)

Application Redirect URL Update severity medium T1078, T1078.004
Dataverse - New non-interactive identity granted access severity informational T0859, T1078, T1098
URL Added to Application from Unknown Domain severity high T1078, T1078.004

YARA-L (1)

Entra ID Excessive Permission Changes to Application severity medium

Update application – Certificates and secrets management

2 detection rules reference this event. View event page.

Sigma (1)

Added Credentials to Existing Application severity high T1098, T1098.001

Elastic (1)

Entra ID Application Credential Modified severity medium T1098, T1098.001

Update conditional access policy

10 detection rules reference this event. View event page.

Sigma (1)

CA Policy Updated by Non Approved Actor severity medium T1548, T1556

Elastic (1)

Entra ID Conditional Access Policy (CAP) Modified severity high T1556, T1556.009

Kusto (7)

Conditional Access - A Conditional Access app exclusion has changed severity low T1071
Conditional Access - A Conditional Access Device platforms condition has changed (the Device platforms condition can be spoofed) severity low T1685, T1686.001
Conditional Access - A Conditional Access policy was disabled severity low T1685, T1686.001
Conditional Access - A Conditional Access policy was put into report-only mode severity low T1685, T1686.001
Conditional Access - A Conditional Access policy was updated severity informational T1685
Conditional Access - A Conditional Access user/group/role exclusion has changed severity high T1078, T1098
Detect suspicious conditional access policy modifications T1556, T1556.009

Panther (1)

Azure MFA Disabled severity high T1078, T1556

Update device

2 detection rules reference this event. View event page.

Sigma (1)

Azure Device or Configuration Modified or Deleted severity medium T1485, T1565, T1565.001

Kusto (1)

Suspicious Entra ID Joined Device Update severity medium T1528

Update group

1 detection rules reference this event. View event page.

Kusto (1)

Conditional Access - Dynamic Group Exclusion Changes severity high T1484

Update named location

1 detection rules reference this event. View event page.

Kusto (1)

Detect suspicious conditional access policy modifications T1556, T1556.009

Update role setting in PIM

3 detection rules reference this event. View event page.

Sigma (1)

Changes To PIM Settings severity high T1078, T1078.004

Elastic (1)

Entra ID Privileged Identity Management (PIM) Role Modified severity medium T1078, T1098, T1098.003

Kusto (1)

Changes to PIM Settings severity high T1078, T1078.004

Update user

10 detection rules reference this event. View event page.

Sigma (2)

Multi Factor Authentication Disabled For User Account severity medium
User State Changed From Guest To Member severity medium T1078, T1078.004

Elastic (1)

Entra ID Guest Account Promoted to Member severity medium T1098

Splunk (3)

Azure AD New MFA Method Registered severity medium T1098, T1098.005
Azure AD User Enabled And Password Reset severity medium T1098
Azure AD User ImmutableId Attribute Updated severity medium T1098

Kusto (4)

Dataverse - Guest user exfiltration following Power Platform defense impairment severity high T1567, T1629
Suspicious linking of existing user to external User severity medium T1078, T1078.004
Suspicious modification of Global Administrator user properties severity medium T1078, T1078.004
User State changed from Guest to Member severity medium T1098

Update User Risk and MFA Registration Policy

1 detection rules reference this event. View event page.

Sigma (1)

User Risk and MFA Registration Policy Updated severity high

User changed default security info

4 detection rules reference this event. View event page.

Kusto (4)

[Entra ID] Authentication Method Changed for Privileged Account severity high T1098
Authentication Methods Changed for Privileged Account severity high T1098
NRT Authentication Methods Changed for VIP Users severity medium T1098
Suspicious Sign In Followed by MFA Modification severity medium T1078, T1078.004, T1556, T1556.006

User deleted security info

5 detection rules reference this event. View event page.

Elastic (1)

Entra ID MFA Disabled for User severity medium T1556, T1556.006

Kusto (4)

[Entra ID] Authentication Method Changed for Privileged Account severity high T1098
Authentication Methods Changed for Privileged Account severity high T1098
NRT Authentication Methods Changed for VIP Users severity medium T1098
Suspicious Sign In Followed by MFA Modification severity medium T1078, T1078.004, T1556, T1556.006

User has elevated their access to User Access Administrator for their Azure Resources

2 detection rules reference this event. View event page.

Elastic (1)

Entra ID Elevated Access to User Access Administrator severity high T1098, T1098.003

Kusto (1)

Azure RBAC (Elevate Access) severity high T1078

User registered security info

8 detection rules reference this event. View event page.

Sigma (1)

Change to Authentication Method severity medium T1098, T1556

Elastic (1)

Entra ID Temporary Access Pass Created for User severity high T1078, T1078.004, T1550

Splunk (1)

Azure AD New MFA Method Registered For User severity medium T1556, T1556.006

Kusto (5)

[Entra ID] Authentication Method Changed for Privileged Account severity high T1098
Authentication Method Changed for Privileged Account severity high T1098
Authentication Methods Changed for Privileged Account severity high T1098
NRT Authentication Methods Changed for VIP Users severity medium T1098
Suspicious Sign In Followed by MFA Modification severity medium T1078, T1078.004, T1556, T1556.006

User reviewed security info

2 detection rules reference this event. View event page.

Kusto (2)

Authentication Methods Changed for Privileged Account severity high T1098
NRT Authentication Methods Changed for VIP Users severity medium T1098

Verify domain

1 detection rules reference this event. View event page.

Elastic (1)

Entra ID Custom Domain Added or Verified severity low T1584, T1584.001

Add eligible member to role in PIM requested (timebound)

1 detection rules reference this event. View event page.

Kusto (1)

Detecting Impossible travel with mailbox permission tampering & Privilege Escalation attempt severity medium T1078, T1548

Add scoped member to role

1 detection rules reference this event. View event page.

Sigma (1)

App Assigned To Azure RBAC/Microsoft Entra Role severity medium T1098, T1098.003

Delete administrative unit

1 detection rules reference this event. View event page.

Sigma (1)

Azure Application Deleted severity medium T1489

Delete device configuration

1 detection rules reference this event. View event page.

Sigma (1)

Azure Device or Configuration Modified or Deleted severity medium T1485, T1565, T1565.001

Device no longer compliant

1 detection rules reference this event. View event page.

Sigma (1)

Azure Device No Longer Managed or Compliant severity medium

Device no longer managed

1 detection rules reference this event. View event page.

Sigma (1)

Azure Device No Longer Managed or Compliant severity medium

Disable PIM alert

1 detection rules reference this event. View event page.

Sigma (1)

PIM Alert Setting Changes To Disabled severity high T1078

Remove owner from application

1 detection rules reference this event. View event page.

Sigma (1)

Azure Owner Removed From Application or Service Principal severity medium

Remove owner from service principal

1 detection rules reference this event. View event page.

Sigma (1)

Azure Owner Removed From Application or Service Principal severity medium

Reset password (by admin)

1 detection rules reference this event. View event page.

Splunk (1)

Azure AD User Enabled And Password Reset severity medium T1098

Update authorization policy

1 detection rules reference this event. View event page.

Splunk (1)

Azure AD Block User Consent For Risky Apps Disabled severity medium T1685

Update device configuration

1 detection rules reference this event. View event page.

Sigma (1)

Azure Device or Configuration Modified or Deleted severity medium T1485, T1565, T1565.001

Update service principal

1 detection rules reference this event. View event page.

Sigma (1)

Application AppID Uri Configuration Changes severity high T1078, T1078.004, T1552

User registered all required security info

1 detection rules reference this event. View event page.

Kusto (1)

Suspicious Sign In Followed by MFA Modification severity medium T1078, T1078.004, T1556, T1556.006

User started security info registration

1 detection rules reference this event. View event page.

Kusto (1)

Suspicious Sign In Followed by MFA Modification severity medium T1078, T1078.004, T1556, T1556.006

Create Temporary Access Pass method for user

1 detection rules reference this event. View event page.

Elastic (1)

Entra ID Temporary Access Pass Created for User severity high T1078, T1078.004, T1550