Azure Audit Logs: Successful Disable Strong Authentication Indicates MFA Disabled
Alerts on successful MFA disable actions in Azure audit logs that could weaken account authentication.
- Product
- azure
- Service
- auditlogs
- Author
- @ionsor (SigmaHQ), DRL 1.1
- Published
- 2022-02-08
- Updated
- 2026-07-31
ATT&CK techniques
Persistence → Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags successful operations named "Disable Strong Authentication" in Azure audit logs, which corresponds to multi-factor authentication being turned off. Attackers may do this to reduce authentication friction and bypass MFA controls as part of credential access or persistence. It relies on audit log telemetry capturing the operation name and success result for the affected directory user or identity context.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-userstates
- learn.microsoft.comhttps://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities#core-directory
- research.splunk.comhttps://research.splunk.com/cloud/482dd42a-acfa-486b-a0bb-d6fcda27318e/
- analyticsrules.exchangehttps://analyticsrules.exchange/analyticrules/65c78944-930b-4cae-bd79-c3664ae30ba7/
- elastic.cohttps://www.elastic.co/docs/reference/security/prebuilt-rules/rules/integrations/azure/persistence_entra_id_mfa_disabled_for_user
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/audit_logs/azure_mfa_disabled.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Azure Audit Logs: Successful Disable Strong Authentication Indicates MFA Disabled"
id: bc162554-8cc9-4350-9d3f-da037f0ebd01
status: test
description: This rule flags successful operations named "Disable Strong Authentication" in Azure audit logs, which corresponds to multi-factor authentication being turned off. Attackers may do this to reduce authentication friction and bypass MFA controls as part of credential access or persistence. It relies on audit log telemetry capturing the operation name and success result for the affected directory user or identity context.
references:
- https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-userstates
- https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities#core-directory
- https://research.splunk.com/cloud/482dd42a-acfa-486b-a0bb-d6fcda27318e/
- https://analyticsrules.exchange/analyticrules/65c78944-930b-4cae-bd79-c3664ae30ba7/
- https://www.elastic.co/docs/reference/security/prebuilt-rules/rules/integrations/azure/persistence_entra_id_mfa_disabled_for_user
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/audit_logs/azure_mfa_disabled.yml
author: "@ionsor, Huntrule Team"
date: 2022-02-08
modified: 2026-04-30
tags:
- attack.credential-access
- attack.persistence
- attack.defense-impairment
- attack.t1556
logsource:
product: azure
service: auditlogs
detection:
selection:
operationName: Disable Strong Authentication
properties.result: success
condition: selection
falsepositives:
- Authorized modification by administrators
level: medium
license: DRL-1.1
related:
- id: 7ea78478-a4f9-42a6-9dcd-f861816122bf
type: derived