Azure Audit Logs: Device No Longer Managed or Compliant

title: "Azure Audit Logs: Device No Longer Managed or Compliant"
id: 31d6ac2f-1b29-464b-8885-574bc91daabb
status: test
description: Identifies audit events where an Azure device is reported as no longer managed or no longer compliant. This can indicate a loss of device posture enforcement, which attackers may exploit to evade security controls or maintain access from an unmanaged endpoint. The rule relies on Azure audit log entries for the specific operation names reflecting the management/compliance status change.
references:
  - https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities#core-directory
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/audit_logs/azure_device_no_longer_managed_or_compliant.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-09-03
modified: 2026-04-30
tags:
  - attack.impact
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    operationName:
      - Device no longer compliant
      - Device no longer managed
  condition: selection
falsepositives:
  - Administrator may have forgotten to review the device.
level: medium
license: DRL-1.1
related:
  - id: 542b9912-c01f-4e3f-89a8-014c48cdca7d
    type: derived