audit

Azure Login Bypassing Conditional Access Policies

Apr 28, 2026 · attack.privilege-escalation attack.persistence attack.initial-access attack.stealth attack.t1078 ·

Detects a successful login to the Microsoft Intune Company Portal which could allow bypassing Conditional Access Policies and InTune device trust using a tool like TokenSmith.

Disabling Multi Factor Authentication

Apr 28, 2026 · attack.persistence attack.credential-access attack.defense-impairment attack.t1556.006 ·

Share on:

Detects disabling of Multi Factor Authentication.

New Federated Domain Added

Apr 28, 2026 · attack.privilege-escalation attack.defense-impairment attack.t1484.002 ·

Share on:

Detects the addition of a new Federated Domain.

Suspicious Email Delivered In Microsoft 365

Apr 27, 2026 · attack.initial-access attack.t1566.001 attack.t1566.002 ·

Share on:

Detects instances where an email, identified as malicious or suspicious by the Microsoft Defender for Office 365 (formerly ATP) engine, was delivered to a user's Inbox or Junk folder. It might indicate that a potential threat, such as a spearphishing attachment or links, has bypassed initial blocking mechanisms and reached an end-user, requiring further investigation and potential remediation.