Azure AD Sign-in Success Without MFA (Single-Factor Authentication)
Alerts on successful Azure AD sign-ins where MFA was not required and only single-factor authentication was used.
- Product
- azure
- Service
- signinlogs
- Author
- MikeDuddington, '@dudders1' (SigmaHQ), DRL 1.1
- Published
- 2022-07-27
- Updated
- 2026-07-31
ATT&CK techniques
Initial Access → Cred AccessRecon
Resource Dev
Initial Access
Execution
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies successful Azure AD sign-ins where the authentication requirement is single-factor authentication, indicating MFA was not required for the attempt. Attackers may use weaker authentication paths to reduce friction and maintain stealth, especially if conditional access or policies are misconfigured or bypassed. Detection relies on Azure sign-in log fields indicating successful status and the reported authentication requirement.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Azure AD Sign-in Success Without MFA (Single-Factor Authentication)
id: ca1d4b00-1132-4323-8664-6e1c46578338
status: test
description: This rule identifies successful Azure AD sign-ins where the authentication requirement is single-factor authentication, indicating MFA was not required for the attempt. Attackers may use weaker authentication paths to reduce friction and maintain stealth, especially if conditional access or policies are misconfigured or bypassed. Detection relies on Azure sign-in log fields indicating successful status and the reported authentication requirement.
references:
- https://learn.microsoft.com/en-gb/entra/architecture/security-operations-user-accounts
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/signin_logs/azure_ad_only_single_factor_auth_required.yml
author: MikeDuddington, '@dudders1', Huntrule Team
date: 2022-07-27
tags:
- attack.privilege-escalation
- attack.persistence
- attack.initial-access
- attack.credential-access
- attack.stealth
- attack.defense-impairment
- attack.t1078.004
- attack.t1556.006
logsource:
product: azure
service: signinlogs
detection:
selection:
Status: Success
AuthenticationRequirement: singleFactorAuthentication
condition: selection
falsepositives:
- If this was approved by System Administrator.
level: low
license: DRL-1.1
related:
- id: 28eea407-28d7-4e42-b0be-575d5ba60b2c
type: derived