Azure Sign-in Logs: MFA Denied Based on Authentication Requirement
Flags Azure sign-ins requiring MFA where the status indicates "MFA Denied."
- Product
- azure
- Service
- signinlogs
- Author
- AlertIQ (SigmaHQ), DRL 1.1
- Published
- 2022-03-24
- Updated
- 2026-07-31
ATT&CK techniques
Initial Access → Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Azure sign-in events where the authentication requirement is multi-factor authentication and the outcome includes the text "MFA Denied." Denying the MFA prompt can indicate an attacker who already has the account password or a user accidentally clicking deny, so it helps surface suspicious authentication attempts. It relies on telemetry from Azure sign-in logs, matching on MFA requirement and the "MFA Denied" status text.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Azure Sign-in Logs: MFA Denied Based on Authentication Requirement"
id: e615b6a8-8e2a-4e99-ab73-f4898c894368
status: test
description: This rule flags Azure sign-in events where the authentication requirement is multi-factor authentication and the outcome includes the text "MFA Denied." Denying the MFA prompt can indicate an attacker who already has the account password or a user accidentally clicking deny, so it helps surface suspicious authentication attempts. It relies on telemetry from Azure sign-in logs, matching on MFA requirement and the "MFA Denied" status text.
references:
- https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/signin_logs/azure_mfa_denies.yml
author: AlertIQ, Huntrule Team
date: 2022-03-24
tags:
- attack.privilege-escalation
- attack.persistence
- attack.initial-access
- attack.credential-access
- attack.stealth
- attack.t1078.004
- attack.t1110
- attack.t1621
logsource:
product: azure
service: signinlogs
detection:
selection:
AuthenticationRequirement: multiFactorAuthentication
Status|contains: MFA Denied
condition: selection
falsepositives:
- Users actually login but miss-click into the Deny button when MFA prompt.
level: medium
license: DRL-1.1
related:
- id: e40f4962-b02b-4192-9bfe-245f7ece1f99
type: derived