Azure Sign-in Logs: Conditional Access Blocks User Token Issuance (ResultType 53003)
Flags Azure sign-in attempts blocked by Conditional Access due to token issuance denial.
- Product
- azure
- Service
- signinlogs
- Author
- AlertIQ (SigmaHQ), DRL 1.1
- Published
- 2021-10-10
- Updated
- 2026-07-31
ATT&CK techniques
Initial Access → Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule matches Azure sign-in events where access was blocked by Conditional Access policies, specifically when token issuance is not allowed (ResultType 53003). Attackers may use stolen or guessed credentials to attempt sign-ins, and Conditional Access blocking can signal such unauthorized attempts against valid accounts. The detection relies on Azure sign-in log telemetry, using the ResultType field to identify blocked access outcomes.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Azure Sign-in Logs: Conditional Access Blocks User Token Issuance (ResultType 53003)"
id: 7b826530-134c-4ec0-8d5f-7351d0a23946
status: test
description: This rule matches Azure sign-in events where access was blocked by Conditional Access policies, specifically when token issuance is not allowed (ResultType 53003). Attackers may use stolen or guessed credentials to attempt sign-ins, and Conditional Access blocking can signal such unauthorized attempts against valid accounts. The detection relies on Azure sign-in log telemetry, using the ResultType field to identify blocked access outcomes.
references:
- https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/signin_logs/azure_user_login_blocked_by_conditional_access.yml
author: AlertIQ, Huntrule Team
date: 2021-10-10
modified: 2022-12-25
tags:
- attack.privilege-escalation
- attack.persistence
- attack.credential-access
- attack.initial-access
- attack.stealth
- attack.t1110
- attack.t1078.004
logsource:
product: azure
service: signinlogs
detection:
selection:
ResultType: 53003
condition: selection
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 9a60e676-26ac-44c3-814b-0c2a8b977adf
type: derived