Detection rules › By event

M365-AzureActiveDirectory

Event	Rules
any	2
Add a partner to cross-tenant access setting.	1
Add app role assignment grant to user.	1
Add app role assignment to service principal.	2
Add application.	3
Add delegated permission grant.	1
Add eligible member to role.	2
Add group.	2
Add member to group.	2
Add member to role.	6
Add owner to application.	1
Add registered users to device.	1
Add service principal.	2
Add user.	2
Change user license.	1
Consent to application.	5
Delete group.	1
Delete partner specific cross-tenant access setting.	1
Disable Strong Authentication.	2
Remove member from group.	1
Set Company Information.	1
Set-MsolDomainFederationSettings	1
Update application – Certificates and secrets management	2
Update application.	8
Update authorization policy.	1
Update policy.	2
Update user.	2

any

2 detection rules reference this event. View event page.

Splunk (1)

O365 Added Service Principal severity medium T1136, T1136.003

Kusto (1)

Malformed user agent severity medium T1071, T1189, T1203

Add a partner to cross-tenant access setting.

1 detection rules reference this event. View event page.

Splunk (1)

O365 Cross-Tenant Access Change severity medium T1484, T1484.002

Add app role assignment grant to user.

1 detection rules reference this event. View event page.

Splunk (1)

O365 Add App Role Assignment Grant User severity medium T1136, T1136.003

Add app role assignment to service principal.

2 detection rules reference this event. View event page.

Splunk (2)

O365 Admin Consent Bypassed by Service Principal severity medium T1098, T1098.003
O365 Service Principal Privilege Escalation severity medium T1098, T1098.003

Add application.

3 detection rules reference this event. View event page.

Splunk (1)

O365 Application Available To Other Tenants severity medium T1098, T1098.003

YARA-L (2)

O365 AD PowerShell App Login Subsequent Activity severity medium T1098, T1098.001
O365 Entra ID Application Creation severity low

Add delegated permission grant.

1 detection rules reference this event. View event page.

YARA-L (1)

O365 AD PowerShell App Login Subsequent Activity severity medium T1098, T1098.001

Add eligible member to role.

2 detection rules reference this event. View event page.

Splunk (2)

O365 Privileged Role Assigned severity medium T1098, T1098.003
O365 Privileged Role Assigned To Service Principal severity medium T1098, T1098.003

Add group.

2 detection rules reference this event. View event page.

YARA-L (2)

Hunt for Office 365 group creation failures severity low
Hunt for Office 365 group creation success severity low

Add member to group.

2 detection rules reference this event. View event page.

YARA-L (2)

Hunt for Office 365 group modification add member success severity low
Office 365 group modification add member success has exceeded a defined threshold severity low

Add member to role.

6 detection rules reference this event. View event page.

Elastic (1)

M365 Identity Global Administrator Role Assigned severity medium T1098, T1098.003

Splunk (3)

O365 High Privilege Role Granted severity medium T1098, T1098.003
O365 Privileged Role Assigned severity medium T1098, T1098.003
O365 Privileged Role Assigned To Service Principal severity medium T1098, T1098.003

YARA-L (2)

O365 Add User To Admin Role severity medium T1098, T1098.003
O365 Recently Created Entra ID User Assigned Roles severity medium T1098, T1098.003

Add owner to application.

1 detection rules reference this event. View event page.

Splunk (1)

O365 Application Registration Owner Added severity medium T1098

Add registered users to device.

1 detection rules reference this event. View event page.

Elastic (1)

M365 Identity OAuth Flow by User Sign-in to Device Registration severity high T1098, T1098.005, T1528, T1566, T1566.002

Add service principal.

2 detection rules reference this event. View event page.

Splunk (2)

O365 Multiple Service Principals Created by SP severity low T1136, T1136.003
O365 Multiple Service Principals Created by User severity low T1136, T1136.003

Add user.

2 detection rules reference this event. View event page.

Splunk (1)

O365 External Guest User Invited severity medium T1136, T1136.003

YARA-L (1)

O365 Recently Created Entra ID User Assigned Roles severity medium T1098, T1098.003

Change user license.

1 detection rules reference this event. View event page.

Splunk (1)

O365 Advanced Audit Disabled severity medium T1685, T1685.002

Delete group.

1 detection rules reference this event. View event page.

YARA-L (1)

Office 365 group deletion success severity low

Delete partner specific cross-tenant access setting.

1 detection rules reference this event. View event page.

Splunk (1)

O365 Cross-Tenant Access Change severity medium T1484, T1484.002

Disable Strong Authentication.

2 detection rules reference this event. View event page.

Sigma (1)

Disabling Multi Factor Authentication severity high T1556, T1556.006

Splunk (1)

O365 Disable MFA severity medium T1556

Remove member from group.

1 detection rules reference this event. View event page.

YARA-L (1)

Hunt for Office 365 group modification remove member success severity low

Set Company Information.

1 detection rules reference this event. View event page.

Splunk (1)

O365 Bypass MFA via Trusted IP severity medium T1686, T1686.001

Set-MsolDomainFederationSettings

1 detection rules reference this event. View event page.

Elastic (1)

M365 Exchange Federated Domain Created or Modified severity low T1484, T1484.002

Update application – Certificates and secrets management

2 detection rules reference this event. View event page.

YARA-L (2)

O365 AD PowerShell App Login Subsequent Activity severity medium T1098, T1098.001
O365 Entra ID App Client Secret Added, Updated or Deleted severity medium T1098, T1098.001

Update application.

8 detection rules reference this event. View event page.

Splunk (4)

O365 Application Available To Other Tenants severity medium T1098, T1098.003
O365 FullAccessAsApp Permission Assigned severity medium T1098, T1098.002, T1098.003
O365 Mailbox Read Access Granted to Application severity medium T1098, T1098.003, T1114, T1114.002
O365 Privileged Graph API Permission Assigned severity medium T1003, T1003.002

YARA-L (4)

O365 AD PowerShell App Login Subsequent Activity severity medium T1098, T1098.001
O365 Entra ID App Modify Permission Change On Watchlist severity medium
O365 Entra ID App Permissions Percent Threshold Exceeded severity medium
O365 Entra ID App Permissions Threshold Exceeded severity medium

Update authorization policy.

1 detection rules reference this event. View event page.

Splunk (1)

O365 Block User Consent For Risky Apps Disabled severity medium T1685

Update policy.

2 detection rules reference this event. View event page.

Splunk (1)

O365 External Identity Policy Changed severity medium T1136, T1136.003

YARA-L (1)

Entra ID conditional access policy modification severity low T1484

Update user.

2 detection rules reference this event. View event page.

Splunk (1)

O365 New MFA Method Registered severity medium T1098, T1098.005

Panther (1)

Microsoft365 MFA Disabled severity low T1556