Azure AD Sign-in Success Without MFA (Single-Factor Authentication)

Alerts on successful Azure AD sign-ins where MFA was not required and only single-factor authentication was used.

FreeReviewedSigma · Low · v5

Product: azure
Service: signinlogs
Author: MikeDuddington, '@dudders1' (SigmaHQ), DRL 1.1
Published: 2022-07-27
Updated: 2026-07-31

ATT&CK techniques

Initial Access → Cred Access

Recon
Resource Dev
Initial Access
- T1078.004Cloud Accounts
Execution
Persistence
- T1078.004Cloud Accounts
- T1556.006Multi-Factor Authentication
Priv Esc
- T1078.004Cloud Accounts
Defense Evasion
- T1078.004Cloud Accounts
- T1556.006Multi-Factor Authentication
Cred Access
- T1556.006Multi-Factor Authentication
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies successful Azure AD sign-ins where the authentication requirement is single-factor authentication, indicating MFA was not required for the attempt. Attackers may use weaker authentication paths to reduce friction and maintain stealth, especially if conditional access or policies are misconfigured or bypassed. Detection relies on Azure sign-in log fields indicating successful status and the reported authentication requirement.

Reporting behind it

Related detections9 linkedT1078.004 — drag to rearrange

Malicious AWS Cross-Account AssumeRole With Suspicious Session Names via CloudTrail (via aws)

Suspicious Okta SSO Access to Many Applications in Short Window

Suspicious Microsoft Entra Device Code Authentication Flow

Suspicious M365 Password Spraying via Azure PowerShell AppId from Quad7 Botnet

Suspicious AWS Instance Access or Export via SSH Key or Export Task

Suspicious Azure OpenAI Model Enumeration and Deployment Creation (via azure)

Suspicious Azure Cognitive Services Account Key Enumeration via ListKeys (via azure)

Malicious Business Email Compromise OAuth Application Sign-In via Entra ID Service Principal (via azure)

Suspicious AWS API Call from TruffleHog Credential Scanner User Agent

Azure AD Sign-in Success Without MFA (Single-Factor Authentication)

Pivot detection · T1078.004 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

azure-ad-sign-in-success-without-mfa-required-single-factor-authentication-28eea407

title: Azure AD Sign-in Success Without MFA (Single-Factor Authentication)
id: ca1d4b00-1132-4323-8664-6e1c46578338
status: test
description: This rule identifies successful Azure AD sign-ins where the authentication requirement is single-factor authentication, indicating MFA was not required for the attempt. Attackers may use weaker authentication paths to reduce friction and maintain stealth, especially if conditional access or policies are misconfigured or bypassed. Detection relies on Azure sign-in log fields indicating successful status and the reported authentication requirement.
references:
  - https://learn.microsoft.com/en-gb/entra/architecture/security-operations-user-accounts
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/signin_logs/azure_ad_only_single_factor_auth_required.yml
author: MikeDuddington, '@dudders1', Huntrule Team
date: 2022-07-27
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.initial-access
  - attack.credential-access
  - attack.stealth
  - attack.defense-impairment
  - attack.t1078.004
  - attack.t1556.006
logsource:
  product: azure
  service: signinlogs
detection:
  selection:
    Status: Success
    AuthenticationRequirement: singleFactorAuthentication
  condition: selection
falsepositives:
  - If this was approved by System Administrator.
level: low
license: DRL-1.1
related:
  - id: 28eea407-28d7-4e42-b0be-575d5ba60b2c
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL