Azure AD Sign-ins from Unknown Devices with Single-Factor Authentication
Alerts on successful Azure sign-ins using single-factor authentication with unknown or missing device identifiers from non-trusted contexts.
- Product
- azure
- Service
- signinlogs
- Author
- Michael Epping, '@mepples21' (SigmaHQ), DRL 1.1
- Published
- 2022-06-28
- Updated
- 2026-07-31
ATT&CK techniques
Initial Access → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Azure AD sign-in events that succeed with single-factor authentication where the sign-in originates from a non-trusted/empty network location details value and the device identifier is blank. Attackers often try to blend in by using unrecognized devices or contexts, so isolating these anomalous successful sign-ins can support investigation and containment. The rule relies on Azure sign-in log telemetry fields including successful result type, authentication requirement, network location details, and device ID.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Azure AD Sign-ins from Unknown Devices with Single-Factor Authentication
id: b8f082e7-4ed9-48af-ad8b-dd1c8197812b
status: test
description: This rule flags Azure AD sign-in events that succeed with single-factor authentication where the sign-in originates from a non-trusted/empty network location details value and the device identifier is blank. Attackers often try to blend in by using unrecognized devices or contexts, so isolating these anomalous successful sign-ins can support investigation and containment. The rule relies on Azure sign-in log telemetry fields including successful result type, authentication requirement, network location details, and device ID.
references:
- https://learn.microsoft.com/en-us/entra/architecture/security-operations-devices#non-compliant-device-sign-in
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/signin_logs/azure_ad_sign_ins_from_unknown_devices.yml
author: Michael Epping, '@mepples21', Huntrule Team
date: 2022-06-28
modified: 2022-10-05
tags:
- attack.privilege-escalation
- attack.persistence
- attack.initial-access
- attack.stealth
- attack.t1078.004
logsource:
product: azure
service: signinlogs
detection:
selection:
AuthenticationRequirement: singleFactorAuthentication
ResultType: 0
NetworkLocationDetails: "[]"
DeviceDetail.deviceId: ""
condition: selection
falsepositives:
- Unknown
level: low
license: DRL-1.1
related:
- id: 4d136857-6a1a-432a-82fc-5dd497ee5e7c
type: derived