Azure AD/Entra Audit Logs: Device Registration Policy Changes
Alerts on Azure audit log events that set or modify the device registration policy.
FreeReviewedSigma · High · v5
- Product
- azure
- Service
- auditlogs
- Author
- Michael Epping, '@mepples21' (SigmaHQ), DRL 1.1
- Published
- 2022-06-28
- Updated
- 2026-07-31
ATT&CK techniques
Priv Esc → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies audit log events where the device registration policy is set or modified. Attackers may change device registration settings to weaken security controls, enabling unauthorized device joins or registrations. It relies on Azure audit log entries that record the policy change activity category and display name.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
azure-ad-device-registration-policy-changes-via-audit-logs-9494bff8
title: "Azure AD/Entra Audit Logs: Device Registration Policy Changes"
id: 013e380c-3504-4172-9938-d864fbb1f722
status: test
description: This rule identifies audit log events where the device registration policy is set or modified. Attackers may change device registration settings to weaken security controls, enabling unauthorized device joins or registrations. It relies on Azure audit log entries that record the policy change activity category and display name.
references:
- https://learn.microsoft.com/en-us/entra/architecture/security-operations-devices#device-registrations-and-joins-outside-policy
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/audit_logs/azure_ad_device_registration_policy_changes.yml
author: Michael Epping, '@mepples21', Huntrule Team
date: 2022-06-28
tags:
- attack.privilege-escalation
- attack.defense-impairment
- attack.t1484
logsource:
product: azure
service: auditlogs
detection:
selection:
Category: Policy
ActivityDisplayName: Set device registration policies
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 9494bff8-959f-4440-bbce-fb87a208d517
type: derived