Microsoft Cloud App Security Activity by Terminated Azure AD User
Alerts on successful "Activity performed by terminated user" events where a terminated Azure AD account still shows activity.
- Product
- m365
- Service
- threat_management
- Author
- Austin Songer @austinsonger (SigmaHQ), DRL 1.1
- Published
- 2021-08-23
- Updated
- 2026-07-31
What it detects
This rule identifies successful "Activity performed by terminated user" events reported by Microsoft Cloud App Security for accounts marked as terminated in Azure AD. Attackers may retain access via alternate identities or continue using an offboarded account to interact with other cloud services, so these events can indicate account lifecycle abuse. The detection relies on threat-management telemetry that includes the event source, event name, and success status from the reporting system.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy
- learn.microsoft.comhttps://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/cloud/m365/threat_management/microsoft365_activity_by_terminated_user.yml
Changelog
v4- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Microsoft Cloud App Security Activity by Terminated Azure AD User
id: ade732a0-e135-4483-aad6-4f6d1e9ab000
status: test
description: This rule identifies successful "Activity performed by terminated user" events reported by Microsoft Cloud App Security for accounts marked as terminated in Azure AD. Attackers may retain access via alternate identities or continue using an offboarded account to interact with other cloud services, so these events can indicate account lifecycle abuse. The detection relies on threat-management telemetry that includes the event source, event name, and success status from the reporting system.
references:
- https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy
- https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/m365/threat_management/microsoft365_activity_by_terminated_user.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-08-23
modified: 2022-10-09
tags:
- attack.impact
logsource:
service: threat_management
product: m365
detection:
selection:
eventSource: SecurityComplianceCenter
eventName: Activity performed by terminated user
status: success
condition: selection
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 2e669ed8-742e-4fe5-b3c4-5a59b486c2ee
type: derived