Azure Audit Logs: Device No Longer Managed or Compliant

title: "Azure Audit Logs: Device No Longer Managed or Compliant"
id: 31d6ac2f-1b29-464b-8885-574bc91daabb
status: test
description: This rule flags audit log events where an Azure device is reported as no longer managed or no longer compliant. Such changes can indicate a breakdown in device governance and may enable attackers to operate from assets that are missing required controls. Detection relies on Azure audit log entries with operation names matching the two relevant compliance/management status messages.
references:
  - https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities#core-directory
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/audit_logs/azure_device_no_longer_managed_or_compliant.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-09-03
modified: 2026-04-30
tags:
  - attack.impact
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    operationName:
      - Device no longer compliant
      - Device no longer managed
  condition: selection
falsepositives:
  - Administrator may have forgotten to review the device.
level: medium
license: DRL-1.1
related:
  - id: 542b9912-c01f-4e3f-89a8-014c48cdca7d
    type: derived