Azure AD Audit: Update User Risk and MFA Registration Policy
Flags Azure AD audit events showing updates to user risk and MFA registration policy.
FreeReviewedSigma · High · v5
- Product
- azure
- Service
- auditlogs
- Author
- Harjot Singh (@cyb3rjy0t) (SigmaHQ), DRL 1.1
- Published
- 2024-08-13
- Updated
- 2026-07-31
What it detects
This rule matches audit log events where the AAD Management UX updates the user risk and MFA registration policy. Changes to these settings can allow an attacker to weaken MFA enforcement or security thresholds, enabling follow-on access attempts and persistence. It relies on Azure audit log fields indicating the logged-by service, category, and the specific policy update operation name.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/entra/id-protection/howto-identity-protection-configure-mfa-policy
- learn.microsoft.comhttps://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/audit_logs/azure_update_risk_and_mfa_registration_policy.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
azure-ad-management-ux-audit-user-risk-and-mfa-registration-policy-updated-d4c7758e
title: "Azure AD Audit: Update User Risk and MFA Registration Policy"
id: 99208a84-0c51-458c-aada-1c29291def89
status: test
description: This rule matches audit log events where the AAD Management UX updates the user risk and MFA registration policy. Changes to these settings can allow an attacker to weaken MFA enforcement or security thresholds, enabling follow-on access attempts and persistence. It relies on Azure audit log fields indicating the logged-by service, category, and the specific policy update operation name.
references:
- https://learn.microsoft.com/en-us/entra/id-protection/howto-identity-protection-configure-mfa-policy
- https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/audit_logs/azure_update_risk_and_mfa_registration_policy.yml
author: Harjot Singh (@cyb3rjy0t), Huntrule Team
date: 2024-08-13
tags:
- attack.persistence
logsource:
product: azure
service: auditlogs
detection:
selection:
LoggedByService: AAD Management UX
Category: Policy
OperationName: Update User Risk and MFA Registration Policy
condition: selection
falsepositives:
- Known updates by administrators.
level: high
license: DRL-1.1
related:
- id: d4c7758e-9417-4f2e-9109-6125d66dabef
type: derived