M365 Audit: Successful Intune Company Portal login via Cmsi
Flags successful Company Portal (Intune) logins via Cmsi audit events that may indicate Conditional Access bypass attempts.
- Product
- m365
- Service
- audit
- Author
- Josh Nickels, Marius Rothenbücher (SigmaHQ), DRL 1.1
- Published
- 2025-01-08
- Updated
- 2026-07-31
ATT&CK techniques
Initial Access → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule matches successful UserLoggedIn audit events for the Microsoft Intune Company Portal application when the request type is Cmsi:Cmsi. Such logins may be used to gain access that depends on Conditional Access and Intune device trust state, making them relevant to attacker attempts to bypass policy controls. It relies on M365 audit telemetry fields including Operation, ApplicationId, ResultStatus, RequestType, and the ObjectId filter used to narrow the event scope.
Reporting behind it
Changelog
v4- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "M365 Audit: Successful Intune Company Portal login via Cmsi"
id: d31b7e61-d420-4176-b38a-56c9842b24ce
status: experimental
description: This rule matches successful UserLoggedIn audit events for the Microsoft Intune Company Portal application when the request type is Cmsi:Cmsi. Such logins may be used to gain access that depends on Conditional Access and Intune device trust state, making them relevant to attacker attempts to bypass policy controls. It relies on M365 audit telemetry fields including Operation, ApplicationId, ResultStatus, RequestType, and the ObjectId filter used to narrow the event scope.
author: Josh Nickels, Marius Rothenbücher, Huntrule Team
references:
- https://labs.jumpsec.com/tokensmith-bypassing-intune-compliant-device-conditional-access/
- https://github.com/JumpsecLabs/TokenSmith
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/m365/audit/microsoft365_bypass_conditional_access.yml
date: 2025-01-08
tags:
- attack.privilege-escalation
- attack.persistence
- attack.initial-access
- attack.stealth
- attack.t1078
logsource:
service: audit
product: m365
detection:
selection:
Operation: UserLoggedIn
ApplicationId: 9ba1a5c7-f17a-4de9-a1f1-6178c8d51223
ResultStatus: Success
RequestType: Cmsi:Cmsi
filter_main_bjectid:
ObjectId: 0000000a-0000-0000-c000-000000000000
condition: selection and not 1 of filter_main_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 13f2d3f5-6497-44a7-bf5f-dc13ffafe5dc
type: derived