Azure Audit Logs: Device No Longer Managed or Compliant
Alerts on Azure device audits indicating the device is no longer managed or compliant.
FreeReviewedSigma · Medium · v5
- Product
- azure
- Service
- auditlogs
- Author
- Austin Songer @austinsonger (SigmaHQ), DRL 1.1
- Published
- 2021-09-03
- Updated
- 2026-07-31
What it detects
Identifies audit events where an Azure device is reported as no longer managed or no longer compliant. This can indicate a loss of device posture enforcement, which attackers may exploit to evade security controls or maintain access from an unmanaged endpoint. The rule relies on Azure audit log entries for the specific operation names reflecting the management/compliance status change.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
azure-audit-logs-device-no-longer-managed-or-compliant-542b9912
title: "Azure Audit Logs: Device No Longer Managed or Compliant"
id: 31d6ac2f-1b29-464b-8885-574bc91daabb
status: test
description: Identifies audit events where an Azure device is reported as no longer managed or no longer compliant. This can indicate a loss of device posture enforcement, which attackers may exploit to evade security controls or maintain access from an unmanaged endpoint. The rule relies on Azure audit log entries for the specific operation names reflecting the management/compliance status change.
references:
- https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities#core-directory
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/audit_logs/azure_device_no_longer_managed_or_compliant.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-09-03
modified: 2026-04-30
tags:
- attack.impact
logsource:
product: azure
service: auditlogs
detection:
selection:
operationName:
- Device no longer compliant
- Device no longer managed
condition: selection
falsepositives:
- Administrator may have forgotten to review the device.
level: medium
license: DRL-1.1
related:
- id: 542b9912-c01f-4e3f-89a8-014c48cdca7d
type: derived