Microsoft 365 Audit: Disabling Strong Authentication (MFA)
Flags Microsoft 365 audit events indicating MFA/strong authentication was disabled.
FreeReviewedSigma · High · v4
- Product
- m365
- Service
- audit
- Author
- Splunk Threat Research Team (original rule), Harjot Singh @cyb3rjy0t (sigma rule) (SigmaHQ), DRL 1.1
- Published
- 2023-09-18
- Updated
- 2026-07-31
ATT&CK techniques
Persistence → Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule matches Microsoft 365 audit events where the operation contains 'Disable Strong Authentication,' indicating MFA/strong authentication has been turned off. Disabling MFA weakens account protections and can enable attackers to maintain access with stolen credentials. It relies on Microsoft 365 audit/service telemetry capturing the specific operation string.
Reporting behind it
Changelog
v4- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
microsoft-365-audit-disabling-strong-authentication-mfa-60de9b57
title: "Microsoft 365 Audit: Disabling Strong Authentication (MFA)"
id: 13099bbb-ec46-4eb3-95c6-ad3b1dd5f9a5
status: test
description: This rule matches Microsoft 365 audit events where the operation contains 'Disable Strong Authentication,' indicating MFA/strong authentication has been turned off. Disabling MFA weakens account protections and can enable attackers to maintain access with stolen credentials. It relies on Microsoft 365 audit/service telemetry capturing the specific operation string.
references:
- https://research.splunk.com/cloud/c783dd98-c703-4252-9e8a-f19d9f5c949e/
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/m365/audit/microsoft365_disabling_mfa.yml
author: Splunk Threat Research Team (original rule), Harjot Singh @cyb3rjy0t (sigma rule), Huntrule Team
date: 2023-09-18
tags:
- attack.persistence
- attack.credential-access
- attack.defense-impairment
- attack.t1556.006
logsource:
service: audit
product: m365
detection:
selection:
Operation|contains: Disable Strong Authentication.
condition: selection
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: 60de9b57-dc4d-48b9-a6a0-b39e0469f876
type: derived