Azure AD sign-ins from non-compliant devices

title: Azure AD sign-ins from non-compliant devices
id: 91c8d75f-b0d2-4656-8d0c-74345266864c
status: test
description: This rule flags authentication events in Entra ID sign-in logs where the originating device is marked as non-compliant. Attackers can use unmanaged or out-of-policy devices to blend in or bypass device compliance controls during access attempts. The detection relies on the sign-in log field indicating device compliance status (DeviceDetail.isCompliant = false).
references:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-devices#non-compliant-device-sign-in
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/signin_logs/azure_ad_sign_ins_from_noncompliant_devices.yml
author: Michael Epping, '@mepples21', Huntrule Team
date: 2022-06-28
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.initial-access
  - attack.stealth
  - attack.t1078.004
logsource:
  product: azure
  service: signinlogs
detection:
  selection:
    DeviceDetail.isCompliant: "false"
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 4f77e1d7-3982-4ee0-8489-abf2d6b75284
    type: derived