Platform: Entra ID

Entra ID User Sign-in with Unusual Authentication Type

Aug 25, 2026 · Domain: Cloud Data Source: Azure Data Source: Microsoft Entra ID Data Source: Microsoft Entra ID Sign-in Logs Platform: Entra ID Use Case: Identity and Access Audit Use Case: Threat Detection Tactic: Initial Access Resources: Investigation Guide ·

Share on:

Identifies rare instances of authentication methods for Microsoft Entra ID principal users. An adversary with stolen credentials may attempt to authenticate with an unusual method, which may indicate an attempt to bypass conditional access policies (CAP) and multi-factor authentication (MFA) requirements. The authentication method may not be commonly used by the user based on their historical sign-in activity.

Entra ID User Sign-in with Unusual Client

Aug 25, 2026 · Domain: Cloud Domain: Identity Data Source: Azure Data Source: Entra ID Data Source: Entra ID Sign-in Platform: Entra ID Use Case: Identity and Access Audit Use Case: Threat Detection Tactic: Initial Access Resources: Investigation Guide ·

Share on:

Detects rare non-interactive sign-ins where an Entra ID client application authenticates on behalf of a principal user using an application (client) ID that is not commonly associated with that user's historical sign-in behavior. Adversaries with stolen credentials or OAuth tokens may abuse Entra ID–managed or first-party client IDs to perform on-behalf-of (OBO) authentication, blending into legitimate cloud traffic while avoiding traditional interactive sign-in flows. This technique is commonly observed in OAuth phishing, token theft, and access broker operations, and may precede lateral movement, persistence, or data access via Microsoft Graph or other cloud resources. The rule uses a New Terms approach to identify first-seen combinations of the UPN and Client ID within a defined history window, helping surface unexpected client usage that may indicate compromised identities, malicious automation, or unauthorized application impersonation.

Entra ID OAuth user_impersonation Scope for Unusual User and Client

Aug 25, 2026 · Domain: Cloud Domain: Identity Use Case: Threat Detection Data Source: Azure Data Source: Microsoft Entra ID Data Source: Microsoft Entra ID Sign-in Logs Platform: Entra ID Tactic: Initial Access Tactic: Defense Evasion Rule Type: New Terms Resources: Investigation Guide ·

Share on:

Identifies rare occurrences of OAuth workflow for a user principal that is single factor authenticated, with an OAuth scope containing user_impersonation for a token issued by Entra ID. Adversaries may use this scope to gain unauthorized access to user accounts, particularly when the sign-in session status is unbound, indicating that the session is not associated with a specific device or session. This behavior is indicative of potential account compromise or unauthorized access attempts. This rule flags when this pattern is detected for a user principal that has not been seen in the last 10 days, indicating potential abuse or unusual activity.

Entra ID User Sign-in with Unusual Non-Managed Device

Aug 18, 2026 · Domain: Cloud Domain: Identity Use Case: Threat Detection Tactic: Persistence Data Source: Azure Data Source: Microsoft Entra ID Data Source: Microsoft Entra ID Sign-in Logs Platform: Entra ID Resources: Investigation Guide ·

Share on:

Identifies when a Microsoft Entra ID user signs in from a device that is not typically used by the user and is not managed, which may indicate potential compromise or unauthorized access attempts. This rule detects unusual sign-in activity by comparing the device used for the sign-in against the user's typical device usage patterns. Adversaries may create and register a new device to obtain a Primary Refresh Token (PRT) and maintain persistent access.