Azure AD: StrongAuthenticationRequirement Set to Disabled/State=0
Alerts on Azure Entra user updates that change StrongAuthenticationRequirement to a disabled State ("State":0).
- Product
- azure
- Service
- auditlogs
- Author
- Harjot Singh (@cyb3rjy0t) (SigmaHQ), DRL 1.1
- Published
- 2024-08-21
- Updated
- 2026-07-31
What it detects
This rule flags Azure AD audit log events where a user account is updated and the StrongAuthenticationRequirement setting is changed to a disabled state (state value of 0). Disabling MFA materially weakens account security and can enable account takeover or persistence by allowing authentication without multi-factor challenges. The detection relies on Azure “Core Directory” UserManagement “Update user” audit log entries that modify the StrongAuthenticationRequirement property and include the new value indicating State=0.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Azure AD: StrongAuthenticationRequirement Set to Disabled/State=0"
id: 203ef5d2-c31c-4554-b495-1aa5b774ec98
status: test
description: This rule flags Azure AD audit log events where a user account is updated and the StrongAuthenticationRequirement setting is changed to a disabled state (state value of 0). Disabling MFA materially weakens account security and can enable account takeover or persistence by allowing authentication without multi-factor challenges. The detection relies on Azure “Core Directory” UserManagement “Update user” audit log entries that modify the StrongAuthenticationRequirement property and include the new value indicating State=0.
references:
- https://www.sans.org/blog/defending-against-scattered-spider-and-the-com-with-cybercrime-intelligence/
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/audit_logs/azure_user_account_mfa_disable.yml
author: Harjot Singh (@cyb3rjy0t), Huntrule Team
date: 2024-08-21
tags:
- attack.credential-access
- attack.persistence
logsource:
product: azure
service: auditlogs
definition: "Requirements: The TargetResources array needs to be mapped accurately in order for this rule to work"
detection:
selection:
LoggedByService: Core Directory
Category: UserManagement
OperationName: Update user
TargetResources.ModifiedProperties.DisplayName: StrongAuthenticationRequirement
TargetResources.ModifiedProperties.NewValue|contains: State":0
condition: selection
falsepositives:
- Legitimate authorized activity.
level: medium
license: DRL-1.1
related:
- id: b18454c8-0be3-41f7-86bc-9c614611b839
type: derived