Azure Sign-In Logs: Device Registration or Join Success Without MFA
Flags successful device registration/join attempts in Azure when MFA was not performed per Conditional Access.
- Product
- azure
- Service
- signinlogs
- Author
- Michael Epping, '@mepples21' (SigmaHQ), DRL 1.1
- Published
- 2022-06-28
- Updated
- 2026-07-31
ATT&CK techniques
Initial Access → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies successful device registration or device join events in Azure sign-in logs where MFA was not performed. Attackers can use device registration without MFA to establish persistence or initial access while reducing friction from authentication controls. The detection relies on sign-in log fields indicating a successful device registration/join service and the absence of multiFactorAuthentication in the authentication requirement telemetry.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Azure Sign-In Logs: Device Registration or Join Success Without MFA"
id: 8e2fbdf4-c618-458d-9bab-076abf78809a
status: test
description: This rule identifies successful device registration or device join events in Azure sign-in logs where MFA was not performed. Attackers can use device registration without MFA to establish persistence or initial access while reducing friction from authentication controls. The detection relies on sign-in log fields indicating a successful device registration/join service and the absence of multiFactorAuthentication in the authentication requirement telemetry.
references:
- https://learn.microsoft.com/en-us/entra/architecture/security-operations-devices#device-registrations-and-joins-outside-policy
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/signin_logs/azure_ad_device_registration_or_join_without_mfa.yml
author: Michael Epping, '@mepples21', Huntrule Team
date: 2022-06-28
tags:
- attack.privilege-escalation
- attack.persistence
- attack.initial-access
- attack.stealth
- attack.t1078.004
logsource:
product: azure
service: signinlogs
detection:
selection:
ResourceDisplayName: Device Registration Service
conditionalAccessStatus: success
filter_mfa:
AuthenticationRequirement: multiFactorAuthentication
condition: selection and not filter_mfa
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 5afa454e-030c-4ab4-9253-a90aa7fcc581
type: derived