Every published rule

Azure Sign-In: Successful single-factor atRisk logins from non-registered devices

Alerts on at-risk successful Azure sign-ins from devices with missing trust type when MFA isn’t required.

Azure sign-in logs: Detect AzureHound discovery tool via default User-Agent

Flags successful Azure sign-ins where the User-Agent contains "azurehound", indicating AzureHound discovery.

Azure AD Account Created and Deleted Shortly After Creation (Audit Logs)

Identifies successful Azure user creation and deletion in quick succession, consistent with short-lived account activity.

Azure Entra Audit Logs: Temporary Access Pass Method Added to an Account

Flags admin registration of a temporary access pass method in Azure audit logs for user accounts.

Azure Entra PIM Role Setting Changes in Audit Logs

Alerts on Azure PIM role setting update events recorded in audit logs.

Azure PIM Alert Setting Disabled (Audit Log Message Detection)

Flags Azure audit log events where PIM alerts are disabled (message: "Disable PIM Alert").

Azure PIM Approval or Denial Recorded in Audit Logs

Flags Azure PIM elevation requests that are approved or denied in audit logs for investigation.

Azure Audit Logs: User Added to Privileged Eligibility Role

Alerts on Azure audit log events indicating a user was added as an eligible or permanent member to a privileged role.

Azure Audit Logs: Removal of Privileged Role Eligible Members

Flags Azure audit log events indicating bulk removal of eligible members from privileged roles.

Azure Audit Logs: Admin-initiated App Role Assignments and Privileged Delegated Permissions

Alerts on Azure audit events where an admin grants app roles to a service principal, enabling privileged application access.

Azure audit logs: Delegated highly privileged permissions granted for all users

Alerts on Azure audit log events where delegated permissions are granted to all users.

Azure Audit Logs: App Granted Microsoft Graph/Exchange/SharePoint/Azure AD Permissions

Alerts on Azure AD audit log entries where an app/service principal is granted delegated or app-role permissions to Microsoft services.

Azure AD Sign-ins from Non-Compliant Devices

Alert on Entra ID sign-ins originating from devices flagged as non-compliant.

Azure Audit Logs: User Added to Global or Device Administrator Roles

Alerts when Azure AD role-management events add users to Global or Device Administrator roles.

Azure AD/Entra Audit Logs: Device Registration Policy Changes

Alerts on Azure audit log events that set or modify the device registration policy.

Azure AD Sign-ins Using Legacy Authentication Client Applications

Alerts on Azure sign-ins using legacy protocol client apps (IMAP/POP3/SMTP/EWS/ActiveSync), which may indicate risky authentication usage.

Azure Audit Logs: Application URI Configuration Changes (AppAddress)

Alerts on Azure audit log events indicating an application URI (AppAddress) was modified.

Azure Audit Logs: Application AppID URI Updates via App or Service Principal Changes

Alerts on Azure audit log entries indicating updates to an application or service principal AppID URI configuration.

Azure Sign-in Logs: Conditional Access Blocked Sign-in Failures (ResultType 53003)

Alerts on Azure sign-ins blocked by Conditional Access when requirements are not met.

Azure AuditLogs: Privileged role assignment to user access admin

Flags Azure AuditLogs events where a user is assigned to User Access Administrator, enabling full subscription management.