Azure AD Management UX Audit: User Risk and MFA Registration Policy Updated

Flags Azure AD audit events showing updates to user risk and MFA registration policy.

FreeUnreviewedSigmahighv1

azure-ad-management-ux-audit-user-risk-and-mfa-registration-policy-updated-d4c7758e

title: "Azure AD Management UX Audit: User Risk and MFA Registration Policy Updated"
id: 99208a84-0c51-458c-aada-1c29291def89
status: test
description: This rule matches audit events where the AAD Management UX service records an update to the "User Risk and MFA Registration Policy." Modifying these settings can reduce authentication enforcement, weakening MFA security and enabling subsequent compromise or persistence. The detection relies on Azure audit logs capturing the LoggedByService, Category, and OperationName values for the policy update.
references:
  - https://learn.microsoft.com/en-us/entra/id-protection/howto-identity-protection-configure-mfa-policy
  - https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/audit_logs/azure_update_risk_and_mfa_registration_policy.yml
author: Harjot Singh (@cyb3rjy0t), Huntrule Team
date: 2024-08-13
tags:
  - attack.persistence
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    LoggedByService: AAD Management UX
    Category: Policy
    OperationName: Update User Risk and MFA Registration Policy
  condition: selection
falsepositives:
  - Known updates by administrators.
level: high
license: DRL-1.1
related:
  - id: d4c7758e-9417-4f2e-9109-6125d66dabef
    type: derived

What it detects

This rule matches audit events where the AAD Management UX service records an update to the "User Risk and MFA Registration Policy." Modifying these settings can reduce authentication enforcement, weakening MFA security and enabling subsequent compromise or persistence. The detection relies on Azure audit logs capturing the LoggedByService, Category, and OperationName values for the policy update.

Known false positives

Known updates by administrators.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.