Sign-in Logs

OperationName	Description	Sample	Rule
any	Any record in this table with no specific result or signal bucket filter. Every record carries OperationName = "Sign-in activity"; detections pivot on field values, not a per-action discriminator.	Y	Y
Success	Record with ResultType 0, the documented success code: the sign-in completed.	Y	Y
Invalid-credentials	Record with ResultType 50126 (bad username or password) or 50056 (null password), the primary brute-force and password spray signal.	Y	Y
Account-locked	Record with ResultType 50053: Microsoft Entra Smart Lockout engaged after repeated sign-in failures on the account.	N	Y
Password-expired	Record with ResultType 50055: the account's password has expired.	N	Y
Disabled	Record with ResultType 50057: sign-in attempted against a disabled account. May indicate an adversary attempting credentials for an account disabled after initial compromise, or a misconfigured service account.	N	Y
MFA-challenged	Record with ResultType 50074 (MFA required, challenge sent but not completed), 50076 or 500121 (MFA required but not satisfied for the resource / failed), or one of 50079, 50072, 53004 (further documented MFA-required-or-failed codes).	N	Y
Blocked-by-CA	Record with ResultType 53003 (blocked by a Conditional Access policy decision) or one of 53000, 53001, 53002, 50131, 50158, 50097 (further documented Conditional-Access-related block codes). Code 50158 (external security challenge not satisfied) can accompany either a passed or a failed challenge, so on its own it is not conclusive of a block. The specific policy and reason are carried in the record's ConditionalAccessPolicies dynamic array.	N	Y
Other	Record whose ResultType is not one of the codes this catalog materializes as its own bucket (for example 700016 application not registered in the tenant, or 90095 admin consent required).	Y	Y
Identity Protection (risk)	Record carrying a populated Identity Protection risk field (RiskState, RiskLevelDuringSignIn, RiskLevelAggregated, or RiskDetail). Populated only when Identity Protection is licensed (Microsoft Entra ID P2); unlicensed tenants receive the literal value hidden.	Y	Y
Target application	Record carrying AppDisplayName, AppId, or ResourceDisplayName: the application signed into and the OAuth resource (API) accessed. Rules hunt unexpected applications acquiring tokens for sensitive resources.	Y	Y
Authentication requirement	Record carrying AuthenticationRequirement (multiFactorAuthentication or singleFactorAuthentication): the policy-required authentication level for the sign-in, not whether MFA succeeded.	Y	Y
Conditional Access status	Record carrying ConditionalAccessStatus (success, failure, or notApplied): whether a Conditional Access policy applied to the sign-in.	Y	Y
Client app (legacy authentication)	Record carrying ClientAppUsed. Legacy authentication clients report values such as Other clients, IMAP, POP3, SMTP, Mapi, AutoDiscover, and Exchange ActiveSync; modern clients report Browser or Mobile Apps and Desktop Clients.	Y	Y

any: Sign-in record (SigninLogs, any result)

Description

Any record in this table with no specific result or signal bucket filter. Every record carries OperationName = "Sign-in activity"; detections pivot on field values, not a per-action discriminator.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`AppId`	14 detection rules	Elastic, Panther
`UserAgent`	13 detection rules	Elastic, Kusto, Panther, Sigma
`OperationName`	12 detection rules	Elastic, Kusto, Panther, Splunk
`ResourceId`	12 detection rules	Elastic, Panther
`UserType`	12 detection rules	Elastic, Panther
`ResultType`	10 detection rules	Elastic, Kusto, Panther, Splunk
`AuthenticationProtocol`	9 detection rules	Elastic, Panther, Splunk
`Category`	7 detection rules	Elastic, Panther, Splunk
`ResultSignature`	7 detection rules	Elastic, Kusto, Panther
`UserPrincipalName`	7 detection rules	Elastic, Kusto, Panther
`ResourceDisplayName`	6 detection rules	Elastic, Panther
`AuthenticationRequirement`	5 detection rules	Elastic, Panther
`RiskState`	5 detection rules	Elastic, Panther
`AppDisplayName`	4 detection rules	Elastic
`IPAddress`	4 detection rules	Kusto, Panther
`ClientAppUsed`	3 detection rules	Elastic
`IncomingTokenType`	3 detection rules	Elastic
`IsInteractive`	3 detection rules	Elastic, Panther
`RiskLevelAggregated`	3 detection rules	Elastic, Panther
`RiskLevelDuringSignIn`	3 detection rules	Elastic, Panther
`AppOwnerTenantId`	2 detection rules	Elastic
`AuthenticationProcessingDetails`	2 detection rules	Elastic
`ConditionalAccessStatus`	2 detection rules	Elastic
`Identity`	2 detection rules	Elastic
`Location`	2 detection rules	Kusto
`OriginalTransferMethod`	2 detection rules	Elastic
`SessionId`	2 detection rules	Elastic, Panther
`TokenIssuerType`	2 detection rules	Elastic
`AutonomousSystemNumber`	1 detection rule	Panther
`ResultDescription`	1 detection rule	Elastic
`TenantId`	1 detection rule	Elastic

Example Sign-in Log Entry #

{
  "AADTenantId": "11111111-1111-1111-1111-111111111111",
  "Agent": {
    "agentType": "notAgentic",
    "agentSubjectType": "notAgentic"
  },
  "AppDisplayName": "Microsoft Office 365 Portal",
  "AppId": "00000006-0000-0ff1-ce00-000000000000",
  "AppOwnerTenantId": "f8cdef31-a31e-4b4a-93e4-5f571e91255a",
  "AppliedEventListeners": "None",
  "AuthenticationContextClassReferences": [],
  "AuthenticationDetails": [
    {
      "authenticationStepDateTime": "2026-07-25T15:45:05.3446797+00:00",
      "authenticationMethod": "Previously satisfied",
      "succeeded": true,
      "authenticationStepResultDetail": "First factor requirement satisfied by claim in the token",
      "authenticationStepRequirement": "",
      "StatusSequence": 0,
      "RequestSequence": 0
    },
    {
      "authenticationStepDateTime": "2026-07-25T15:45:05.3446797+00:00",
      "authenticationMethod": "Previously satisfied",
      "authenticationMethodDetail": "",
      "succeeded": true,
      "authenticationStepResultDetail": "MFA requirement satisfied by claim in the token",
      "authenticationStepRequirement": ""
    }
  ],
  "AuthenticationProcessingDetails": [
    {
      "key": "Is Client Capable",
      "value": "True"
    },
    {
      "key": "Legacy TLS (TLS 1.0, 1.1, 3DES)",
      "value": "False"
    },
    {
      "key": "Is Legacy Store Used",
      "value": "False"
    },
    {
      "key": "Is CAE Token",
      "value": "True"
    }
  ],
  "AuthenticationProtocol": "none",
  "AuthenticationRequirement": "multiFactorAuthentication",
  "AuthenticationRequirementPolicies": [
    {
      "requirementProvider": "securityDefaults",
      "detail": "Security Defaults"
    }
  ],
  "AutonomousSystemNumber": "64512",
  "Category": "SignInLogs",
  "ClientAppUsed": "Browser",
  "ClientCredentialType": "none",
  "ConditionalAccessAudiences": [
    "00000006-0000-0ff1-ce00-000000000000"
  ],
  "ConditionalAccessPolicies": [
    {
      "id": "SecurityDefaults",
      "displayName": "Security Defaults",
      "enforcedGrantControls": [
        "Mfa"
      ],
      "result": "success",
      "conditionsSatisfied": 3,
      "conditionsNotSatisfied": 0
    }
  ],
  "ConditionalAccessStatus": "notApplied",
  "CorrelationId": "bdaead9d-757c-4d71-b6a1-79948aa7aeca",
  "CreatedDateTime": "2026-07-25T15:45:05.3446797Z",
  "CrossTenantAccessType": "none",
  "DeviceDetail": {
    "deviceId": "",
    "operatingSystem": "MacOs",
    "browser": "Firefox 152.0",
    "isCompliant": false,
    "isManaged": false
  },
  "DurationMs": "0",
  "FlaggedForReview": "None",
  "HomeTenantId": "11111111-1111-1111-1111-111111111111",
  "IPAddress": "2001:db8::10",
  "Id": "e1dfa18f-4e2e-4e4d-bca7-eff8263e2c00",
  "Identity": "Admin User",
  "IncomingTokenType": "none",
  "IsInteractive": "True",
  "IsRisky": "None",
  "IsTenantRestricted": "False",
  "IsThroughGlobalSecureAccess": "False",
  "Location": "US",
  "LocationDetails": {
    "city": "Redacted",
    "state": "Redacted",
    "countryOrRegion": "US",
    "geoCoordinates": {
      "latitude": 0.0,
      "longitude": 0.0
    }
  },
  "MfaDetail": "None",
  "OperationName": "Sign-in activity",
  "OperationVersion": "1.0",
  "OriginalRequestId": "e1dfa18f-4e2e-4e4d-bca7-eff8263e2c00",
  "OriginalTransferMethod": "none",
  "ProcessingTimeInMilliseconds": "107",
  "Resource": "Microsoft.aadiam",
  "ResourceDisplayName": "Windows Azure Active Directory",
  "ResourceGroup": "Microsoft.aadiam",
  "ResourceId": "/tenants/11111111-1111-1111-1111-111111111111/providers/Microsoft.aadiam",
  "ResourceIdentity": "00000002-0000-0000-c000-000000000000",
  "ResourceOwnerTenantId": "f8cdef31-a31e-4b4a-93e4-5f571e91255a",
  "ResourceServicePrincipalId": "32296670-c2e0-46c9-9094-e0149fb34fa3",
  "ResourceTenantId": "11111111-1111-1111-1111-111111111111",
  "ResultSignature": "SUCCESS",
  "ResultType": "0",
  "RiskDetail": "hidden",
  "RiskEventTypes": [],
  "RiskEventTypes_V2": [],
  "RiskLevelAggregated": "hidden",
  "RiskLevelDuringSignIn": "hidden",
  "RiskState": "none",
  "ServicePrincipalId": "a982479a-70f4-45cb-8790-6495238e4eed",
  "ServicePrincipalName": "Microsoft Office 365 Portal",
  "SessionId": "0022840a-e4ab-884c-587f-d20d24637227",
  "SessionLifetimePolicies": [],
  "Status": {
    "errorCode": 0,
    "additionalDetails": "MFA requirement satisfied by claim in the token"
  },
  "TokenIssuerType": "AzureAD",
  "TokenProtectionStatusDetails": {
    "signInSessionStatus": "unbound",
    "signInSessionStatusCode": 1002
  },
  "UniqueTokenIdentifier": "j6Hf4S5OTU68p-_4Jj4sAA",
  "UserAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:152.0) Gecko/20100101 Firefox/152.0",
  "UserDisplayName": "Admin User",
  "UserId": "aaaaaaaa-0000-0000-0000-000000000001",
  "UserPrincipalName": "adminuser@example.onmicrosoft.com",
  "UserType": "Member"
}

Common Indicators #

Positive field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis. This is separate from Fields accounting, which also includes exclusions and counts distinct attached rules.

Field	Kind	Value	Rules	Vendors
`event.outcome` (elastic rule field)	eq	`success`	17 rules	elastic
`azure_ad::user_type` (elastic rule field)	eq	`member`	10 rules	elastic
`EventType` (elastic rule field)	eq	`sign-in activity`	7 rules	elastic
`azure_ad::app_id` (elastic rule field)	eq	`29d9ed98-a469-4536-ade2-f981bc1d605e`	5 rules	elastic
`Active` (kusto rule field)	eq	`true`	4 rules	kusto
`SigninLogs_TimeGenerated` (kusto rule field)	cross_field_compare	`ExpirationDateTime`	4 rules	kusto
`SigninLogs_TimeGenerated` (kusto rule field)	cross_field_compare	`ValidUntil`	3 rules	kusto
`azure_ad::resource_id` (elastic rule field)	eq	`00000002-0000-0000-c000-000000000000`	3 rules	elastic
`azure_ad::resource_id` (elastic rule field)	in	`00000003-0000-0000-c000-000000000000`	4 rules	elastic
`security_result.action (Chronicle)`	eq	`ALLOW`	4 rules	chronicle
`ActivityType` (kusto rule field)	in	`FailedLogOn`	3 rules	kusto
`ActivityType` (kusto rule field)	in	`LogOn`	3 rules	kusto
`azure_ad::authentication_protocol` (elastic rule field)	eq	`devicecode`	3 rules	elastic
`azure_ad::authentication_requirement` (elastic rule field)	eq	`singlefactorauthentication`	3 rules	elastic
`azure_ad::user_principal_name` (elastic rule field)	is_not_null		3 rules	elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Sign-ins from Non-Compliant Devices source high: Monitor and alert for sign-ins where the device was non-compliant.T1078, T1078.004
Application Using Device Code Authentication Flow source medium: Device code flow is an OAuth 2.0 protocol flow specifically for input constrained devices and is not used in all environments. If this type of flow is seen in the environment and not being used in an input constrained device scenario, further investigation is warranted. This can be a misconfigured application or potentially something malicious.T1078
Applications That Are Using ROPC Authentication Flow source medium: Resource owner password credentials (ROPC) should be avoided if at all possible as this requires the user to expose their current password credentials to the application directly. The application then uses those credentials to authenticate the user against the identity provider.T1078

Show 1 more (4 total) on the rules page

Elastic #

M365 or Entra ID Identity Sign-in from a Suspicious Source source high: This rule correlate Entra-ID or Microsoft 365 mail successful sign-in events with network security alerts by source address. Adversaries may trigger some network security alerts such as reputation or other anomalies before accessing cloud resources.T1078
Entra ID Sharepoint or OneDrive Accessed by Unusual Client source medium: Identifies when an application accesses SharePoint Online or OneDrive for Business for the first time in the tenant within a specified timeframe. This detects successful OAuth phishing campaigns, illicit consent grants, or compromised third-party applications gaining initial access to file storage. Adversaries often use malicious OAuth applications or phishing techniques to gain consent from users, allowing persistent access to organizational data repositories without traditional credential theft.T1078, T1078.004, T1098, T1098.001, T1213, T1213.002
Entra ID OAuth Device Code Flow with Concurrent Sign-ins source high: Identifies Entra ID device code authentication flows where multiple user agents are observed within the same session. This pattern is indicative of device code phishing, where an attacker's polling client (e.g., Python script) and the victim's browser both appear in the same authentication session. In legitimate device code flows, the user authenticates via browser while the requesting application polls for tokens - when these have distinctly different user agents (e.g., Python Requests vs Chrome), it may indicate the code was phished and redeemed by an attacker.T1078, T1078.004, T1528, T1566, T1566.002

Show 17 more (31 total) on the rules page

Splunk #

Azure AD Device Code Authentication source: The following analytic identifies Azure Device Code Phishing attacks, which can lead to Azure Account Take-Over (ATO). It leverages Azure AD SignInLogs to detect suspicious authentication requests using the device code authentication…T1528, T1566, T1566.002
Azure AD Multiple Denied MFA Requests For User source: The following analytic detects an unusually high number of denied Multi-Factor Authentication (MFA) requests for a single user within a 10-minute window, specifically when more than nine MFA prompts are declined. It leverages Azure Active…T1621
Detect Distributed Password Spray Attempts source: This analytic employs the 3-sigma approach to identify distributed password spray attacks. A distributed password spray attack is a type of brute force attack where the attacker attempts a few common passwords against many different…T1110, T1110.003

Show 2 more (5 total) on the rules page

Kusto #

Anomaly Sign In Event from an IP source medium: Identifies sign-in anomalies from an IP in the last hour, targeting multiple users where the password is correct after multiple attemptsT1078
Lumen TI IPAddress in SigninLogs source medium: This query maps Lumen IP indicators of compromise (IOCs) from threat intelligence (TI), by searching for matches in SigninLogs.T1071
Insider Risk_Sensitive Data Access Outside Organizational Geo-location source high: This alert joins Azure Information Protection Logs (InformationProtectionLogs_CL) with Microsoft Entra ID Sign in Logs (SigninLogs) to provide a correlation of sensitive data access by geo-location. Results include User Principal Name, Label Name, Activity, City, State, Country/Region, and Time Generated. Recommended configuration is to include (or exclude) Sign in geo-locations (City, State, Country and/or Region) for trusted organizational locations. There is an option for configuration of correlations against Microsoft Sentinel watchlists. Accessing sensitive data from a new or unauthorized geo-location warrants further review. For more information see Sign-in logs in Microsoft Entra ID: Location FilteringT1567

Show 17 more (39 total) on the rules page

YARA-L #

Entra ID Admin Login Activity to Uncommon MS Cloud Apps source medium: Detects Azure AD admin login activity to apps other than a defined list of first party MS Cloud Apps. Note that Azure Active Directory PowerShell and custom Azure apps are not in this list by defaultT1078, T1078.004
Microsoft Entra ID Device code phishing attack source high: Detects strong indicators of a successful device code phishing attack.T1566
Entra ID Login Activity to Azure AD PowerShell Application source medium: Logins to Azure AD PowerShell app can have legitimate purposes, but are also abused to gain access to user information. Programatic access to Azure AD should generally be through other apps

Show 2 more (5 total) on the rules page

Panther #

Azure Device Code Authentication with Broker Client source medium: Detects device code authentication using the Microsoft Broker Client application, which may indicate Primary Refresh Token (PRT) abuse. Device code flow allows adversaries to trick users into entering codes on attacker-controlled applications. When combined with Microsoft Broker Client (app ID 29d9ed98-a469-4536-ade2-f981bc1d605e), this may indicate PRT theft or replay attacks that bypass MFA and Conditional Access policies.T1078, T1078.004, T1550, T1550.001, T1566, T1566.002
Azure Excessive Account Lockouts source high: Detects high volumes of failed Microsoft Entra ID sign-in attempts resulting in account lockouts, indicating potential brute-force credential attacks such as password spraying, password guessing, or credential stuffing. When adversaries repeatedly attempt authentication with incorrect credentials, Entra ID Smart Lockout policies trigger account lockouts (error code 50053).T1110, T1110.001, T1110.003, T1110.004
Azure Many Failed SignIns source medium: This detection looks for a number of failed sign-ins for the same ServicePrincipalName or UserPrincipalNameT1078, T1110

Show 9 more (12 total) on the rules page

Success: Successful sign-in

Description

Record with ResultType 0, the documented success code: the sign-in completed.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`ResultType`	23 detection rules	Kusto, Sigma
`AuthenticationRequirement`	6 detection rules	Kusto, Sigma, Splunk
`Category`	5 detection rules	Elastic, Splunk
`AppDisplayName`	4 detection rules	Kusto, Splunk
`UserAgent`	4 detection rules	Kusto, Sigma
`UserPrincipalName`	4 detection rules	Elastic, Kusto
`AppId`	3 detection rules	Kusto
`AutonomousSystemNumber`	3 detection rules	Kusto
`Location`	3 detection rules	Kusto
`Status`	3 detection rules	Sigma
`NetworkLocationDetails`	2 detection rules	Kusto, Sigma
`RiskLevelDuringSignIn`	2 detection rules	Kusto
`RiskState`	2 detection rules	Kusto, Sigma
`IPAddress`	1 detection rule	Kusto
`OperationName`	1 detection rule	Splunk
`OriginalRequestId`	1 detection rule	Kusto
`RiskLevelAggregated`	1 detection rule	Kusto
`TimeGenerated`	1 detection rule	Kusto
`UniqueTokenIdentifier`	1 detection rule	Kusto
`UserId`	1 detection rule	Kusto

Example Sign-in Log Entry #

{
  "AADTenantId": "11111111-1111-1111-1111-111111111111",
  "Agent": {
    "agentType": "notAgentic",
    "agentSubjectType": "notAgentic"
  },
  "AppDisplayName": "Microsoft Office 365 Portal",
  "AppId": "00000006-0000-0ff1-ce00-000000000000",
  "AppOwnerTenantId": "f8cdef31-a31e-4b4a-93e4-5f571e91255a",
  "AppliedEventListeners": "None",
  "AuthenticationContextClassReferences": [],
  "AuthenticationDetails": [
    {
      "authenticationStepDateTime": "2026-07-25T15:45:05.3446797+00:00",
      "authenticationMethod": "Previously satisfied",
      "succeeded": true,
      "authenticationStepResultDetail": "First factor requirement satisfied by claim in the token",
      "authenticationStepRequirement": "",
      "StatusSequence": 0,
      "RequestSequence": 0
    },
    {
      "authenticationStepDateTime": "2026-07-25T15:45:05.3446797+00:00",
      "authenticationMethod": "Previously satisfied",
      "authenticationMethodDetail": "",
      "succeeded": true,
      "authenticationStepResultDetail": "MFA requirement satisfied by claim in the token",
      "authenticationStepRequirement": ""
    }
  ],
  "AuthenticationProcessingDetails": [
    {
      "key": "Is Client Capable",
      "value": "True"
    },
    {
      "key": "Legacy TLS (TLS 1.0, 1.1, 3DES)",
      "value": "False"
    },
    {
      "key": "Is Legacy Store Used",
      "value": "False"
    },
    {
      "key": "Is CAE Token",
      "value": "True"
    }
  ],
  "AuthenticationProtocol": "none",
  "AuthenticationRequirement": "multiFactorAuthentication",
  "AuthenticationRequirementPolicies": [
    {
      "requirementProvider": "securityDefaults",
      "detail": "Security Defaults"
    }
  ],
  "AutonomousSystemNumber": "64512",
  "Category": "SignInLogs",
  "ClientAppUsed": "Browser",
  "ClientCredentialType": "none",
  "ConditionalAccessAudiences": [
    "00000006-0000-0ff1-ce00-000000000000"
  ],
  "ConditionalAccessPolicies": [
    {
      "id": "SecurityDefaults",
      "displayName": "Security Defaults",
      "enforcedGrantControls": [
        "Mfa"
      ],
      "result": "success",
      "conditionsSatisfied": 3,
      "conditionsNotSatisfied": 0
    }
  ],
  "ConditionalAccessStatus": "notApplied",
  "CorrelationId": "bdaead9d-757c-4d71-b6a1-79948aa7aeca",
  "CreatedDateTime": "2026-07-25T15:45:05.3446797Z",
  "CrossTenantAccessType": "none",
  "DeviceDetail": {
    "deviceId": "",
    "operatingSystem": "MacOs",
    "browser": "Firefox 152.0",
    "isCompliant": false,
    "isManaged": false
  },
  "DurationMs": "0",
  "FlaggedForReview": "None",
  "HomeTenantId": "11111111-1111-1111-1111-111111111111",
  "IPAddress": "2001:db8::10",
  "Id": "e1dfa18f-4e2e-4e4d-bca7-eff8263e2c00",
  "Identity": "Admin User",
  "IncomingTokenType": "none",
  "IsInteractive": "True",
  "IsRisky": "None",
  "IsTenantRestricted": "False",
  "IsThroughGlobalSecureAccess": "False",
  "Location": "US",
  "LocationDetails": {
    "city": "Redacted",
    "state": "Redacted",
    "countryOrRegion": "US",
    "geoCoordinates": {
      "latitude": 0.0,
      "longitude": 0.0
    }
  },
  "MfaDetail": "None",
  "OperationName": "Sign-in activity",
  "OperationVersion": "1.0",
  "OriginalRequestId": "e1dfa18f-4e2e-4e4d-bca7-eff8263e2c00",
  "OriginalTransferMethod": "none",
  "ProcessingTimeInMilliseconds": "107",
  "Resource": "Microsoft.aadiam",
  "ResourceDisplayName": "Windows Azure Active Directory",
  "ResourceGroup": "Microsoft.aadiam",
  "ResourceId": "/tenants/11111111-1111-1111-1111-111111111111/providers/Microsoft.aadiam",
  "ResourceIdentity": "00000002-0000-0000-c000-000000000000",
  "ResourceOwnerTenantId": "f8cdef31-a31e-4b4a-93e4-5f571e91255a",
  "ResourceServicePrincipalId": "32296670-c2e0-46c9-9094-e0149fb34fa3",
  "ResourceTenantId": "11111111-1111-1111-1111-111111111111",
  "ResultSignature": "SUCCESS",
  "ResultType": "0",
  "RiskDetail": "hidden",
  "RiskEventTypes": [],
  "RiskEventTypes_V2": [],
  "RiskLevelAggregated": "hidden",
  "RiskLevelDuringSignIn": "hidden",
  "RiskState": "none",
  "ServicePrincipalId": "a982479a-70f4-45cb-8790-6495238e4eed",
  "ServicePrincipalName": "Microsoft Office 365 Portal",
  "SessionId": "0022840a-e4ab-884c-587f-d20d24637227",
  "SessionLifetimePolicies": [],
  "Status": {
    "errorCode": 0,
    "additionalDetails": "MFA requirement satisfied by claim in the token"
  },
  "TokenIssuerType": "AzureAD",
  "TokenProtectionStatusDetails": {
    "signInSessionStatus": "unbound",
    "signInSessionStatusCode": 1002
  },
  "UniqueTokenIdentifier": "j6Hf4S5OTU68p-_4Jj4sAA",
  "UserAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:152.0) Gecko/20100101 Firefox/152.0",
  "UserDisplayName": "Admin User",
  "UserId": "aaaaaaaa-0000-0000-0000-000000000001",
  "UserPrincipalName": "adminuser@example.onmicrosoft.com",
  "UserType": "Member"
}

Common Indicators #

Field	Kind	Value	Rules	Vendors
`ResultType`	eq	`0`	21 rules	kusto, sigma
`ResultType` (kusto rule field)	in	`0`	3 rules	kusto
`category` (splunk rule field)	eq	`signinlogs`	4 rules	splunk
`properties.authenticationDetails{}.succeeded` (splunk rule field)	eq	`true`	4 rules	splunk
`Status` (sigma rule field)	eq	`success`	3 rules	sigma
`azure_ad::authentication_requirement` (sigma rule field)	eq	`singlefactorauthentication`	3 rules	sigma
`AppId` (kusto rule field)	is_not_null		2 rules	kusto
`DeviceAction` (kusto rule field)	ne	`Block`	2 rules	kusto
`DeviceProduct` (kusto rule field)	starts_with	`FireWall`	2 rules	kusto
`DeviceProduct` (kusto rule field)	starts_with	`FortiGate`	2 rules	kusto
`DeviceProduct` (kusto rule field)	starts_with	`NSSWeblog`	2 rules	kusto
`DeviceProduct` (kusto rule field)	starts_with	`PAN`	2 rules	kusto
`DeviceProduct` (kusto rule field)	starts_with	`URL`	2 rules	kusto
`DeviceProduct` (kusto rule field)	starts_with	`VPN`	2 rules	kusto
`DeviceVendor` (kusto rule field)	contains	`check point`	2 rules	kusto

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Discovery Using AzureHound source high: Detects AzureHound (A BloodHound data collector for Microsoft Azure) activity via the default User-Agent that is used during its operation after successful authentication.T1087, T1087.004, T1526
Azure AD Only Single Factor Authentication Required source low: Detect when users are authenticating without MFA being required.T1078, T1078.004, T1556, T1556.006↳ also matches Authentication requirement: Sign-in recording an authentication requirement
Suspicious SignIns From A Non Registered Device source high: Detects risky authentication from a non AD registered device without MFA being required.T1078↳ also matches Identity Protection (risk): Sign-in with an Identity Protection risk assessment, Authentication requirement: Sign-in recording an authentication requirement

Show 2 more (5 total) on the rules page

Elastic #

Microsoft Entra ID Impossible Travel Sign-in source high: Detects successful Microsoft Entra ID interactive sign-ins for the same user from two geographically separated locations within a 90-minute window, where the implied travel speed between the two points exceeds what is physically possible (>=800 km/h, faster than modern commercial airliners) and the geographic separation is at least 500 km. This pattern indicates either VPN/proxy use or an adversary signing in to a compromised account from a different location than the legitimate user. Non-interactive sign-in categories are excluded because backend token refresh activity routinely egresses through cloud regions unrelated to the user. This activity is often observed from AiTM phishing kits or successful phishing campaigns.T1078, T1078.004, T1528, T1557

Splunk #

Azure AD Multiple AppIDs and UserAgents Authentication Spike source: The following analytic detects unusual authentication activity in Azure AD, specifically when a single user account has over 8 authentication attempts using 3+ unique application IDs and 5+ unique user agents within a short period. It…T1078↳ also matches Authentication requirement: Sign-in recording an authentication requirement
Azure AD Successful Authentication From Different Ips source: The following analytic detects an Azure AD account successfully authenticating from multiple unique IP addresses within a 30-minute window. It leverages Azure AD SignInLogs to identify instances where the same user logs in from different…T1110, T1110.001, T1110.003
Azure AD Successful PowerShell Authentication source: The following analytic identifies a successful authentication event against an Azure AD tenant using PowerShell cmdlets. This detection leverages Azure AD SignInLogs to identify successful logins where the appDisplayName is "Microsoft…T1078, T1078.004, T1586, T1586.003↳ also matches Target application: Sign-in naming a target application

Show 1 more (4 total) on the rules page

Kusto #

Failed AWS Console logons but success logon to AzureAD source medium: Identifies a list of IP addresses with a minimum number (default of 5) of failed logon attempts to AWS Console. Uses that list to identify any successful Microsoft Entra ID logons from these IPs within the same timeframe.T1078, T1110↳ also matches Other: Sign-in with another recorded result
Risky user signin observed in non-Microsoft network device source medium: This content is utilized to identify instances of successful login by risky users, who have been observed engaging in potentially suspicious network activity on non-Microsoft network devices.T1071↳ also matches Identity Protection (risk): Sign-in with an Identity Protection risk assessment
M365D Alerts Correlation to non-Microsoft Network device network activity involved in successful sign-in Activity source medium: This content is employed to correlate with Microsoft Defender XDR phishing-related alerts. It focuses on instances where a user successfully connects to a phishing URL from a non-Microsoft network device and subsequently makes successful sign-in attempts from the phishing IP address.T1078

Show 17 more (22 total) on the rules page

Invalid-credentials: Sign-in with invalid credentials

Description

Record with ResultType 50126 (bad username or password) or 50056 (null password), the primary brute-force and password spray signal.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`Category`	6 detection rules	Elastic, Splunk
`ResultType`	6 detection rules	Elastic, Splunk
`UserAgent`	2 detection rules	Elastic
`UserPrincipalName`	2 detection rules	Elastic
`AuthenticationRequirement`	1 detection rule	Elastic
`ResourceDisplayName`	1 detection rule	Elastic

Example Sign-in Log Entry #

{
  "AADTenantId": "11111111-1111-1111-1111-111111111111",
  "Agent": {
    "agentType": "notAgentic",
    "agentSubjectType": "notAgentic"
  },
  "AlternateSignInName": "dwharn-signin-64f96b62@example.onmicrosoft.com",
  "AppDisplayName": "dw-signin-password-probe-64f96b62",
  "AppId": "5ef99b61-c0dc-423d-b174-4d12253e5e9c",
  "AppOwnerTenantId": "11111111-1111-1111-1111-111111111111",
  "AppliedEventListeners": "None",
  "AuthenticationContextClassReferences": [],
  "AuthenticationDetails": [
    {
      "authenticationStepDateTime": "2026-07-26T02:29:55.638094+00:00",
      "authenticationMethod": "Password",
      "authenticationMethodDetail": "Password in the cloud",
      "succeeded": false,
      "authenticationStepResultDetail": "Invalid username or password or Invalid on-premise username or password.",
      "authenticationStepRequirement": "",
      "StatusSequence": 0,
      "RequestSequence": 1
    }
  ],
  "AuthenticationProcessingDetails": [
    {
      "key": "Legacy TLS (TLS 1.0, 1.1, 3DES)",
      "value": "False"
    },
    {
      "key": "Is Legacy Store Used",
      "value": "False"
    },
    {
      "key": "Is CAE Token",
      "value": "False"
    }
  ],
  "AuthenticationProtocol": "none",
  "AuthenticationRequirement": "singleFactorAuthentication",
  "AuthenticationRequirementPolicies": [],
  "AutonomousSystemNumber": "64512",
  "Category": "SignInLogs",
  "ClientAppUsed": "Mobile Apps and Desktop clients",
  "ClientCredentialType": "none",
  "ConditionalAccessAudiences": [],
  "ConditionalAccessPolicies": [],
  "ConditionalAccessStatus": "notApplied",
  "CorrelationId": "1e5fe688-8508-4c4e-b576-010770b58094",
  "CreatedDateTime": "2026-07-26T02:29:55.638094Z",
  "CrossTenantAccessType": "none",
  "DeviceDetail": {
    "deviceId": "",
    "operatingSystem": "",
    "browser": "",
    "isCompliant": false,
    "isManaged": false
  },
  "DurationMs": "0",
  "FlaggedForReview": "None",
  "HomeTenantId": "11111111-1111-1111-1111-111111111111",
  "IPAddress": "203.0.113.10",
  "Id": "3f8bdb16-67a5-4a70-a6d5-4f62cd2c2b00",
  "Identity": "dw harness sign-in probe",
  "IncomingTokenType": "none",
  "IsInteractive": "True",
  "IsRisky": "None",
  "IsTenantRestricted": "False",
  "IsThroughGlobalSecureAccess": "False",
  "Location": "US",
  "LocationDetails": {
    "city": "Redacted",
    "state": "Redacted",
    "countryOrRegion": "US",
    "geoCoordinates": {
      "latitude": 0.0,
      "longitude": 0.0
    }
  },
  "MfaDetail": "None",
  "OperationName": "Sign-in activity",
  "OperationVersion": "1.0",
  "OriginalRequestId": "3f8bdb16-67a5-4a70-a6d5-4f62cd2c2b00",
  "OriginalTransferMethod": "none",
  "ProcessingTimeInMilliseconds": "99",
  "Resource": "Microsoft.aadiam",
  "ResourceDisplayName": "Microsoft Graph",
  "ResourceGroup": "Microsoft.aadiam",
  "ResourceId": "/tenants/11111111-1111-1111-1111-111111111111/providers/Microsoft.aadiam",
  "ResourceIdentity": "00000003-0000-0000-c000-000000000000",
  "ResourceOwnerTenantId": "f8cdef31-a31e-4b4a-93e4-5f571e91255a",
  "ResourceServicePrincipalId": "2e5ab30e-ae89-43c2-b130-0022f3d655a7",
  "ResourceTenantId": "11111111-1111-1111-1111-111111111111",
  "ResultDescription": "Error validating credentials due to invalid username or password.",
  "ResultSignature": "FAILURE",
  "ResultType": "50126",
  "RiskDetail": "none",
  "RiskEventTypes": [],
  "RiskEventTypes_V2": [],
  "RiskLevelAggregated": "none",
  "RiskLevelDuringSignIn": "none",
  "RiskState": "none",
  "ServicePrincipalId": "00000000-0000-0000-0000-000000000000",
  "ServicePrincipalName": "dw-signin-password-probe-64f96b62",
  "SessionLifetimePolicies": [],
  "SignInIdentifier": "dwharn-signin-64f96b62@example.onmicrosoft.com",
  "Status": {
    "errorCode": 50126,
    "failureReason": "Error validating credentials due to invalid username or password."
  },
  "TokenIssuerType": "AzureAD",
  "TokenProtectionStatusDetails": {
    "signInSessionStatus": "none",
    "signInSessionStatusCode": 0
  },
  "UniqueTokenIdentifier": "FtuLP6VncEqm1U9izSwrAA",
  "UserAgent": "Python-urllib/3.11",
  "UserDisplayName": "dw harness sign-in probe",
  "UserId": "5acb823e-47b2-4675-9305-213624ea5ff4",
  "UserPrincipalName": "dwharn-signin-64f96b62@example.onmicrosoft.com",
  "UserType": "Member"
}

Common Indicators #

Field	Kind	Value	Rules	Vendors
`category` (splunk rule field)	eq	`signinlogs`	4 rules	splunk
`properties.authenticationDetails{}.succeeded` (splunk rule field)	eq	`false`	4 rules	splunk
`properties.status.errorCode` (splunk rule field)	eq	`50126`	4 rules	splunk
`aws::userAgent` (elastic rule field)	ne	`mozilla/5.0 (compatible; msal 1.0) pkeyauth/1.0`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`120000`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`120002`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`120020`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50034`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50055`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50056`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50057`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50064`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50076`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50079`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50105`	2 rules	elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

Entra ID User Sign-in Brute Force Attempted source medium: Identifies potential brute-force attacks targeting user accounts by analyzing failed sign-in patterns in Microsoft Entra ID Sign-In Logs. This detection focuses on a high volume of failed interactive or non-interactive authentication attempts within a short time window, often indicative of password spraying, credential stuffing, or password guessing. Adversaries may use these techniques to gain unauthorized access to applications integrated with Entra ID or to compromise valid user accounts.T1110, T1110.001, T1110.003, T1110.004↳ also matches Password-expired: Sign-in blocked by expired password, Disabled: Sign-in attempted against a disabled account, MFA-challenged: Sign-in with an incomplete or failed MFA challenge, Other: Sign-in with another recorded result, Authentication requirement: Sign-in recording an authentication requirement
Entra ID Sign-in Brute Force Attempted (Microsoft 365) source medium: Identifies potential brute-force attacks targeting Microsoft 365 user accounts by analyzing failed sign-in patterns in Microsoft Entra ID Sign-In Logs. This detection focuses on a high volume of failed interactive or non-interactive authentication attempts within a short time window, often indicative of password spraying, credential stuffing, or password guessing. Adversaries may use these techniques to gain unauthorized access to Microsoft 365 services such as Exchange Online, SharePoint, or Teams.T1110, T1110.001, T1110.003, T1110.004↳ also matches Password-expired: Sign-in blocked by expired password, Disabled: Sign-in attempted against a disabled account, MFA-challenged: Sign-in with an incomplete or failed MFA challenge, Other: Sign-in with another recorded result, Target application: Sign-in naming a target application

Splunk #

Azure AD High Number Of Failed Authentications For User source: The following analytic identifies an Azure AD account experiencing more than 20 failed authentication attempts within a 10-minute window. This detection leverages Azure SignInLogs data, specifically monitoring for error code 50126 and…T1110, T1110.001
Azure AD High Number Of Failed Authentications From Ip source: The following analytic detects an IP address with 20 or more failed authentication attempts to an Azure AD tenant within 10 minutes. It leverages Azure AD SignInLogs to identify repeated failed logins from the same IP. This behavior is…T1110, T1110.001, T1110.003
Azure AD Multiple Users Failing To Authenticate From Ip source: The following analytic detects a single source IP failing to authenticate with 30 unique valid users within 5 minutes in Azure Active Directory. It leverages Azure AD SignInLogs with error code 50126, indicating invalid passwords. This…T1110, T1110.003, T1110.004, T1586, T1586.003

Show 1 more (4 total) on the rules page

Account-locked: Sign-in blocked by account lockout

Description

Record with ResultType 50053: Microsoft Entra Smart Lockout engaged after repeated sign-in failures on the account.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`ResultType`	2 detection rules	Elastic, Sigma
`AuthenticationRequirement`	1 detection rule	Elastic
`Category`	1 detection rule	Elastic
`UserPrincipalName`	1 detection rule	Elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Account Lockout source medium: Identifies user account which has been locked because the user tried to sign in too many times with an incorrect user ID or password.T1110

Elastic #

Entra ID Excessive Account Lockouts Detected source high: Identifies a high count of failed Microsoft Entra ID sign-in attempts as the result of the target user account being locked out. Adversaries may attempt to brute-force user accounts by repeatedly trying to authenticate with incorrect credentials, leading to account lockouts by Entra ID Smart Lockout policies.T1110, T1110.001, T1110.003, T1110.004↳ also matches Authentication requirement: Sign-in recording an authentication requirement

Password-expired: Sign-in blocked by expired password

Description

Record with ResultType 50055: the account's password has expired.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`Category`	2 detection rules	Elastic
`ResultType`	2 detection rules	Elastic
`UserAgent`	2 detection rules	Elastic
`UserPrincipalName`	2 detection rules	Elastic
`AuthenticationRequirement`	1 detection rule	Elastic
`ResourceDisplayName`	1 detection rule	Elastic

Common Indicators #

Field	Kind	Value	Rules	Vendors
`aws::userAgent` (elastic rule field)	ne	`mozilla/5.0 (compatible; msal 1.0) pkeyauth/1.0`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`120000`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`120002`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`120020`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50034`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50055`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50056`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50057`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50064`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50076`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50079`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50105`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50126`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50135`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50142`	2 rules	elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

Entra ID User Sign-in Brute Force Attempted source medium: Identifies potential brute-force attacks targeting user accounts by analyzing failed sign-in patterns in Microsoft Entra ID Sign-In Logs. This detection focuses on a high volume of failed interactive or non-interactive authentication attempts within a short time window, often indicative of password spraying, credential stuffing, or password guessing. Adversaries may use these techniques to gain unauthorized access to applications integrated with Entra ID or to compromise valid user accounts.T1110, T1110.001, T1110.003, T1110.004↳ also matches Invalid-credentials: Sign-in with invalid credentials, Disabled: Sign-in attempted against a disabled account, MFA-challenged: Sign-in with an incomplete or failed MFA challenge, Other: Sign-in with another recorded result, Authentication requirement: Sign-in recording an authentication requirement
Entra ID Sign-in Brute Force Attempted (Microsoft 365) source medium: Identifies potential brute-force attacks targeting Microsoft 365 user accounts by analyzing failed sign-in patterns in Microsoft Entra ID Sign-In Logs. This detection focuses on a high volume of failed interactive or non-interactive authentication attempts within a short time window, often indicative of password spraying, credential stuffing, or password guessing. Adversaries may use these techniques to gain unauthorized access to Microsoft 365 services such as Exchange Online, SharePoint, or Teams.T1110, T1110.001, T1110.003, T1110.004↳ also matches Invalid-credentials: Sign-in with invalid credentials, Disabled: Sign-in attempted against a disabled account, MFA-challenged: Sign-in with an incomplete or failed MFA challenge, Other: Sign-in with another recorded result, Target application: Sign-in naming a target application

Disabled: Sign-in attempted against a disabled account

Description

Record with ResultType 50057: sign-in attempted against a disabled account. May indicate an adversary attempting credentials for an account disabled after initial compromise, or a misconfigured service account.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`ResultType`	5 detection rules	Elastic, Kusto, Sigma
`Category`	2 detection rules	Elastic
`ResultDescription`	2 detection rules	Sigma
`UserAgent`	2 detection rules	Elastic
`UserPrincipalName`	2 detection rules	Elastic
`AuthenticationRequirement`	1 detection rule	Elastic
`ResourceDisplayName`	1 detection rule	Elastic
`TimeGenerated`	1 detection rule	Kusto

Common Indicators #

Field	Kind	Value	Rules	Vendors
`ResultType`	eq	`50057`	3 rules	kusto, sigma
`aws::userAgent` (elastic rule field)	ne	`mozilla/5.0 (compatible; msal 1.0) pkeyauth/1.0`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`120000`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`120002`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`120020`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50034`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50055`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50056`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50057`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50064`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50076`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50079`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50105`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50126`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50135`	2 rules	elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Account Disabled or Blocked for Sign in Attempts source medium: Detects when an account is disabled or blocked for sign in but tried to log inT1078, T1078.004
Login to Disabled Account source medium: Detect failed attempts to sign in to disabled accounts.T1078, T1078.004

Elastic #

Entra ID User Sign-in Brute Force Attempted source medium: Identifies potential brute-force attacks targeting user accounts by analyzing failed sign-in patterns in Microsoft Entra ID Sign-In Logs. This detection focuses on a high volume of failed interactive or non-interactive authentication attempts within a short time window, often indicative of password spraying, credential stuffing, or password guessing. Adversaries may use these techniques to gain unauthorized access to applications integrated with Entra ID or to compromise valid user accounts.T1110, T1110.001, T1110.003, T1110.004↳ also matches Invalid-credentials: Sign-in with invalid credentials, Password-expired: Sign-in blocked by expired password, MFA-challenged: Sign-in with an incomplete or failed MFA challenge, Other: Sign-in with another recorded result, Authentication requirement: Sign-in recording an authentication requirement
Entra ID Sign-in Brute Force Attempted (Microsoft 365) source medium: Identifies potential brute-force attacks targeting Microsoft 365 user accounts by analyzing failed sign-in patterns in Microsoft Entra ID Sign-In Logs. This detection focuses on a high volume of failed interactive or non-interactive authentication attempts within a short time window, often indicative of password spraying, credential stuffing, or password guessing. Adversaries may use these techniques to gain unauthorized access to Microsoft 365 services such as Exchange Online, SharePoint, or Teams.T1110, T1110.001, T1110.003, T1110.004↳ also matches Invalid-credentials: Sign-in with invalid credentials, Password-expired: Sign-in blocked by expired password, MFA-challenged: Sign-in with an incomplete or failed MFA challenge, Other: Sign-in with another recorded result, Target application: Sign-in naming a target application

Kusto #

High risk Office operation conducted by IP Address that recently attempted to log into a disabled account source medium: It is possible that a disabled user account is compromised and another account on the same IP is used to perform operations that are not typical for that user. The query filters the SigninLogs for entries where ResultType is indicates a disabled account and the TimeGenerated is within a defined time range. It then summarizes these entries by IPAddress and AppId, calculating various statistics such as number of login attempts, distinct UPNs, App IDs etc and joins these results with another set of results from SigninLogs, filtering for entries with less than normal number of successful sign-ins. It then filters out entries where there were no successful sign-ins or where successful sign-ins did not occur within the same lookback period as the failed sign-ins, later projecting relevant fields by the count of login attempts, and expands the set of successful sign-ins into individual events. Finally, it joins these results with entries from OfficeActivity where certain operations deemed rare and high risk have been performed, ensuring their occurrance within a certain time range of the successful sign-ins.T1078, T1098, T1114↳ also matches Success: Successful sign-in

MFA-challenged: Sign-in with an incomplete or failed MFA challenge

Description

Record with ResultType 50074 (MFA required, challenge sent but not completed), 50076 or 500121 (MFA required but not satisfied for the resource / failed), or one of 50079, 50072, 53004 (further documented MFA-required-or-failed codes).

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`ResultType`	8 detection rules	Elastic, Kusto, Sigma, Splunk
`Category`	4 detection rules	Elastic, Splunk
`UserAgent`	2 detection rules	Elastic
`UserPrincipalName`	2 detection rules	Elastic
`AppDisplayName`	1 detection rule	Kusto
`AuthenticationRequirement`	1 detection rule	Elastic
`OperationName`	1 detection rule	Splunk
`ResourceDisplayName`	1 detection rule	Elastic
`ResultDescription`	1 detection rule	Sigma

Common Indicators #

Field	Kind	Value	Rules	Vendors
`ResultType`	eq	`500121`	2 rules	kusto, sigma
`ResultType` (kusto rule field)	in	`50074`	2 rules	kusto
`ResultType` (kusto rule field)	in	`50076`	2 rules	kusto
`ResultType` (kusto rule field)	in	`0`	1 rule	kusto
`category` (splunk rule field)	eq	`signinlogs`	2 rules	splunk
`properties.status.errorCode` (splunk rule field)	eq	`500121`	2 rules	splunk
`ActivityType` (kusto rule field)	in	`FailedLogOn`	1 rule	kusto
`ActivityType` (kusto rule field)	in	`LogOn`	1 rule	kusto
`SourceIPAddress` (kusto rule field)	is_not_null		1 rule	kusto
`UEBARiskScore` (kusto rule field)	gt	`3`	1 rule	kusto
`count` (splunk rule field)	gt	`10`	1 rule	splunk

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Multifactor Authentication Interrupted source medium: Identifies user login with multifactor authentication failures, which might be an indication an attacker has the password for the account but can't pass the MFA challenge.T1078, T1078.004, T1110, T1621

Elastic #

Entra ID User Sign-in Brute Force Attempted source medium: Identifies potential brute-force attacks targeting user accounts by analyzing failed sign-in patterns in Microsoft Entra ID Sign-In Logs. This detection focuses on a high volume of failed interactive or non-interactive authentication attempts within a short time window, often indicative of password spraying, credential stuffing, or password guessing. Adversaries may use these techniques to gain unauthorized access to applications integrated with Entra ID or to compromise valid user accounts.T1110, T1110.001, T1110.003, T1110.004↳ also matches Invalid-credentials: Sign-in with invalid credentials, Password-expired: Sign-in blocked by expired password, Disabled: Sign-in attempted against a disabled account, Other: Sign-in with another recorded result, Authentication requirement: Sign-in recording an authentication requirement
Entra ID Sign-in Brute Force Attempted (Microsoft 365) source medium: Identifies potential brute-force attacks targeting Microsoft 365 user accounts by analyzing failed sign-in patterns in Microsoft Entra ID Sign-In Logs. This detection focuses on a high volume of failed interactive or non-interactive authentication attempts within a short time window, often indicative of password spraying, credential stuffing, or password guessing. Adversaries may use these techniques to gain unauthorized access to Microsoft 365 services such as Exchange Online, SharePoint, or Teams.T1110, T1110.001, T1110.003, T1110.004↳ also matches Invalid-credentials: Sign-in with invalid credentials, Password-expired: Sign-in blocked by expired password, Disabled: Sign-in attempted against a disabled account, Other: Sign-in with another recorded result, Target application: Sign-in naming a target application

Splunk #

Azure AD Authentication Failed During MFA Challenge source: The following analytic identifies failed authentication attempts against an Azure AD tenant during the Multi-Factor Authentication (MFA) challenge, specifically flagged by error code 500121. It leverages Azure AD SignInLogs to detect these…T1078, T1078.004, T1586, T1586.003, T1621
Azure AD Multiple Failed MFA Requests For User source: The following analytic identifies multiple failed multi-factor authentication (MFA) requests for a single user within an Azure AD tenant. It leverages Azure AD Sign-in Logs, specifically error code 500121, to detect more than 10 failed MFA…T1078, T1078.004, T1586, T1586.003, T1621

Kusto #

Failed sign-ins into LastPass due to MFA source low: This rule will check if a sign-in failed into LastPass due to MFA. An incident can indicate the potential brute forcing of a LastPass account. The use of MFA is identified by combining the sign-in logs, this rule assumes LastPass is federated to Entra ID.T1078, T1190↳ also matches Target application: Sign-in naming a target application
Cisco - firewall block but success logon to Microsoft Entra ID source medium: Correlate IPs blocked by a Cisco firewall appliance with successful Microsoft Entra ID signins. Because the IP was blocked by the firewall, that same IP logging on successfully to Entra ID is potentially suspect and could indicate credential compromise for the user account.T1078↳ also matches Success: Successful sign-in
MFA Rejected by User source medium: Identifies occurances where a user has rejected an MFA prompt. This could be an indicator that a threat actor has compromised the username and password of this user account and is using it to try and log into the account. Ref : https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-user-accounts#monitoring-for-failed-unusual-sign-ins This query has also been updated to include UEBA logs IdentityInfo and BehaviorAnalytics for contextual information around the results. Please note, MFA Failed logons from known IP ranges can be benign depending on the conditional access policies. In case of noisy behavior, consider tuning the source IP ranges or location filter after careful considerationT1078, T1078.004

Blocked-by-CA: Sign-in blocked by Conditional Access

Description

Record with ResultType 53003 (blocked by a Conditional Access policy decision) or one of 53000, 53001, 53002, 50131, 50158, 50097 (further documented Conditional-Access-related block codes). Code 50158 (external security challenge not satisfied) can accompany either a passed or a failed challenge, so on its own it is not conclusive of a block. The specific policy and reason are carried in the record's ConditionalAccessPolicies dynamic array.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`ResultType`	3 detection rules	Sigma
`ResultDescription`	2 detection rules	Sigma

Common Indicators #

Field	Kind	Value	Rules	Vendors
`ResultType` (sigma rule field)	eq	`53003`	2 rules	sigma

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Sign-in Failure Due to Conditional Access Requirements Not Met source high: Define a baseline threshold for failed sign-ins due to Conditional Access failuresT1078, T1078.004, T1110
Azure Unusual Authentication Interruption source medium: Detects when there is a interruption in the authentication process.T1078↳ also matches Other: Sign-in with another recorded result
User Access Blocked by Azure Conditional Access source medium: Detect access has been blocked by Conditional Access policies. The access policy does not allow token issuance which might be sights≈ of unauthorizeed login to valid accounts.T1078, T1078.004, T1110

Other: Sign-in with another recorded result

Description

Record whose ResultType is not one of the codes this catalog materializes as its own bucket (for example 700016 application not registered in the tenant, or 90095 admin consent required).

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`ResultType`	6 detection rules	Elastic, Kusto, Sigma
`Category`	2 detection rules	Elastic
`ResourceDisplayName`	2 detection rules	Elastic, Kusto
`UserAgent`	2 detection rules	Elastic
`UserPrincipalName`	2 detection rules	Elastic
`AppDisplayName`	1 detection rule	Kusto
`AuthenticationRequirement`	1 detection rule	Elastic
`IPAddress`	1 detection rule	Kusto
`ResultDescription`	1 detection rule	Sigma

Example Sign-in Log Entry #

{
  "AADTenantId": "11111111-1111-1111-1111-111111111111",
  "Agent": {
    "agentType": "notAgentic",
    "agentSubjectType": "notAgentic"
  },
  "AppDisplayName": "Microsoft Azure CLI",
  "AppId": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
  "AppOwnerTenantId": "f8cdef31-a31e-4b4a-93e4-5f571e91255a",
  "AppliedEventListeners": "None",
  "AuthenticationContextClassReferences": [],
  "AuthenticationDetails": [
    {
      "authenticationStepDateTime": "2026-07-26T02:24:29.3775727+00:00",
      "authenticationMethod": "Previously satisfied",
      "succeeded": true,
      "authenticationStepResultDetail": "First factor requirement satisfied by claim in the token",
      "authenticationStepRequirement": "",
      "StatusSequence": 0,
      "RequestSequence": 0
    },
    {
      "authenticationStepDateTime": "2026-07-26T02:24:29.3775727+00:00",
      "authenticationMethod": "Previously satisfied",
      "authenticationMethodDetail": "",
      "succeeded": true,
      "authenticationStepResultDetail": "MFA requirement satisfied by claim in the token",
      "authenticationStepRequirement": ""
    }
  ],
  "AuthenticationProcessingDetails": [
    {
      "key": "Legacy TLS (TLS 1.0, 1.1, 3DES)",
      "value": "False"
    },
    {
      "key": "Is Legacy Store Used",
      "value": "False"
    },
    {
      "key": "Is CAE Token",
      "value": "False"
    }
  ],
  "AuthenticationProtocol": "none",
  "AuthenticationRequirement": "multiFactorAuthentication",
  "AuthenticationRequirementPolicies": [
    {
      "requirementProvider": "securityDefaults",
      "detail": "Security Defaults"
    }
  ],
  "AutonomousSystemNumber": "64512",
  "Category": "SignInLogs",
  "ClientAppUsed": "Mobile Apps and Desktop clients",
  "ClientCredentialType": "none",
  "ConditionalAccessAudiences": [
    "797f4846-ba00-4fd7-ba43-dac1f8f63013"
  ],
  "ConditionalAccessPolicies": [
    {
      "id": "SecurityDefaults",
      "displayName": "Security Defaults",
      "enforcedGrantControls": [
        "Mfa"
      ],
      "result": "success",
      "conditionsSatisfied": 3,
      "conditionsNotSatisfied": 0
    }
  ],
  "ConditionalAccessStatus": "notApplied",
  "CorrelationId": "8ee9beb6-93b4-4337-a949-265d70809f9d",
  "CreatedDateTime": "2026-07-26T02:24:29.3775727Z",
  "CrossTenantAccessType": "none",
  "DeviceDetail": {
    "deviceId": "",
    "operatingSystem": "Linux",
    "browser": "Firefox 152.0",
    "isCompliant": false,
    "isManaged": false
  },
  "DurationMs": "0",
  "FlaggedForReview": "None",
  "HomeTenantId": "11111111-1111-1111-1111-111111111111",
  "IPAddress": "203.0.113.10",
  "Id": "87fd81bb-382b-4989-b215-6eb0f8172500",
  "Identity": "Admin User",
  "IncomingTokenType": "none",
  "IsInteractive": "True",
  "IsRisky": "None",
  "IsTenantRestricted": "False",
  "IsThroughGlobalSecureAccess": "False",
  "Location": "US",
  "LocationDetails": {
    "city": "Redacted",
    "state": "Redacted",
    "countryOrRegion": "US",
    "geoCoordinates": {
      "latitude": 0.0,
      "longitude": 0.0
    }
  },
  "MfaDetail": "None",
  "OperationName": "Sign-in activity",
  "OperationVersion": "1.0",
  "OriginalRequestId": "87fd81bb-382b-4989-b215-6eb0f8172500",
  "OriginalTransferMethod": "deviceCodeFlow",
  "ProcessingTimeInMilliseconds": "105",
  "Resource": "Microsoft.aadiam",
  "ResourceDisplayName": "Azure Resource Manager",
  "ResourceGroup": "Microsoft.aadiam",
  "ResourceId": "/tenants/11111111-1111-1111-1111-111111111111/providers/Microsoft.aadiam",
  "ResourceIdentity": "797f4846-ba00-4fd7-ba43-dac1f8f63013",
  "ResourceOwnerTenantId": "f8cdef31-a31e-4b4a-93e4-5f571e91255a",
  "ResourceServicePrincipalId": "0a5a0151-c294-4242-9427-7bc688760df5",
  "ResourceTenantId": "11111111-1111-1111-1111-111111111111",
  "ResultDescription": "For security reasons, user confirmation is required for this request. Please repeat the request allowing user interaction.",
  "ResultSignature": "FAILURE",
  "ResultType": "50199",
  "RiskDetail": "none",
  "RiskEventTypes": [],
  "RiskEventTypes_V2": [],
  "RiskLevelAggregated": "none",
  "RiskLevelDuringSignIn": "none",
  "RiskState": "none",
  "ServicePrincipalId": "00000000-0000-0000-0000-000000000000",
  "ServicePrincipalName": "Microsoft Azure CLI",
  "SessionId": "006ea83a-2932-54d9-1731-544dd799b8f0",
  "SessionLifetimePolicies": [],
  "Status": {
    "errorCode": 50199,
    "failureReason": "For security reasons, user confirmation is required for this request. Please repeat the request allowing user interaction.",
    "additionalDetails": "MFA requirement satisfied by claim in the token"
  },
  "TokenIssuerType": "AzureAD",
  "TokenProtectionStatusDetails": {
    "signInSessionStatus": "unbound",
    "signInSessionStatusCode": 1002
  },
  "UniqueTokenIdentifier": "u4H9hys4iUmyFW6w-BclAA",
  "UserAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:152.0) Gecko/20100101 Firefox/152.0",
  "UserDisplayName": "Admin User",
  "UserId": "aaaaaaaa-0000-0000-0000-000000000001",
  "UserPrincipalName": "adminuser@example.onmicrosoft.com",
  "UserType": "Member"
}

Common Indicators #

Field	Kind	Value	Rules	Vendors
`ResultType` (kusto rule field)	in	`0`	2 rules	kusto

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Azure Unusual Authentication Interruption source medium: Detects when there is a interruption in the authentication process.T1078↳ also matches Blocked-by-CA: Sign-in blocked by Conditional Access

Elastic #

Entra ID User Sign-in Brute Force Attempted source medium: Identifies potential brute-force attacks targeting user accounts by analyzing failed sign-in patterns in Microsoft Entra ID Sign-In Logs. This detection focuses on a high volume of failed interactive or non-interactive authentication attempts within a short time window, often indicative of password spraying, credential stuffing, or password guessing. Adversaries may use these techniques to gain unauthorized access to applications integrated with Entra ID or to compromise valid user accounts.T1110, T1110.001, T1110.003, T1110.004↳ also matches Invalid-credentials: Sign-in with invalid credentials, Password-expired: Sign-in blocked by expired password, Disabled: Sign-in attempted against a disabled account, MFA-challenged: Sign-in with an incomplete or failed MFA challenge, Authentication requirement: Sign-in recording an authentication requirement
Entra ID Sign-in Brute Force Attempted (Microsoft 365) source medium: Identifies potential brute-force attacks targeting Microsoft 365 user accounts by analyzing failed sign-in patterns in Microsoft Entra ID Sign-In Logs. This detection focuses on a high volume of failed interactive or non-interactive authentication attempts within a short time window, often indicative of password spraying, credential stuffing, or password guessing. Adversaries may use these techniques to gain unauthorized access to Microsoft 365 services such as Exchange Online, SharePoint, or Teams.T1110, T1110.001, T1110.003, T1110.004↳ also matches Invalid-credentials: Sign-in with invalid credentials, Password-expired: Sign-in blocked by expired password, Disabled: Sign-in attempted against a disabled account, MFA-challenged: Sign-in with an incomplete or failed MFA challenge, Target application: Sign-in naming a target application

Kusto #

Expired access credentials being used in Azure source medium: This query searches for logins with an expired access credential (for example an expired cookie). It then matches the IP address from which the expired credential access occurred with the IP addresses of successful logins. If there are logins with expired credentials, but no successful logins from an IP, this might indicate an attacker has copied the authentication cookie and is re-using it on another machine.T1528↳ also matches Target application: Sign-in naming a target application
Failed AWS Console logons but success logon to AzureAD source medium: Identifies a list of IP addresses with a minimum number (default of 5) of failed logon attempts to AWS Console. Uses that list to identify any successful Microsoft Entra ID logons from these IPs within the same timeframe.T1078, T1110↳ also matches Success: Successful sign-in
Detect non-admin requesting token for admin applications source: This rule detects sign-in attempts from non-admin users to admin applications in Entra ID.T1651↳ also matches Success: Successful sign-in, Target application: Sign-in naming a target application

Identity Protection (risk): Sign-in with an Identity Protection risk assessment

Description

Record carrying a populated Identity Protection risk field (RiskState, RiskLevelDuringSignIn, RiskLevelAggregated, or RiskDetail). Populated only when Identity Protection is licensed (Microsoft Entra ID P2); unlicensed tenants receive the literal value hidden.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`ResultType`	3 detection rules	Kusto
`RiskLevelDuringSignIn`	3 detection rules	Kusto
`RiskState`	3 detection rules	Kusto, Sigma
`RiskLevelAggregated`	2 detection rules	Kusto
`AppDisplayName`	1 detection rule	Kusto
`AuthenticationRequirement`	1 detection rule	Sigma
`OriginalRequestId`	1 detection rule	Kusto
`Status`	1 detection rule	Sigma
`UserId`	1 detection rule	Kusto

Example Sign-in Log Entry #

{
  "AADTenantId": "11111111-1111-1111-1111-111111111111",
  "Agent": {
    "agentType": "notAgentic",
    "agentSubjectType": "notAgentic"
  },
  "AppDisplayName": "Microsoft Office 365 Portal",
  "AppId": "00000006-0000-0ff1-ce00-000000000000",
  "AppOwnerTenantId": "f8cdef31-a31e-4b4a-93e4-5f571e91255a",
  "AppliedEventListeners": "None",
  "AuthenticationContextClassReferences": [],
  "AuthenticationDetails": [
    {
      "authenticationStepDateTime": "2026-07-25T15:45:05.3446797+00:00",
      "authenticationMethod": "Previously satisfied",
      "succeeded": true,
      "authenticationStepResultDetail": "First factor requirement satisfied by claim in the token",
      "authenticationStepRequirement": "",
      "StatusSequence": 0,
      "RequestSequence": 0
    },
    {
      "authenticationStepDateTime": "2026-07-25T15:45:05.3446797+00:00",
      "authenticationMethod": "Previously satisfied",
      "authenticationMethodDetail": "",
      "succeeded": true,
      "authenticationStepResultDetail": "MFA requirement satisfied by claim in the token",
      "authenticationStepRequirement": ""
    }
  ],
  "AuthenticationProcessingDetails": [
    {
      "key": "Is Client Capable",
      "value": "True"
    },
    {
      "key": "Legacy TLS (TLS 1.0, 1.1, 3DES)",
      "value": "False"
    },
    {
      "key": "Is Legacy Store Used",
      "value": "False"
    },
    {
      "key": "Is CAE Token",
      "value": "True"
    }
  ],
  "AuthenticationProtocol": "none",
  "AuthenticationRequirement": "multiFactorAuthentication",
  "AuthenticationRequirementPolicies": [
    {
      "requirementProvider": "securityDefaults",
      "detail": "Security Defaults"
    }
  ],
  "AutonomousSystemNumber": "64512",
  "Category": "SignInLogs",
  "ClientAppUsed": "Browser",
  "ClientCredentialType": "none",
  "ConditionalAccessAudiences": [
    "00000006-0000-0ff1-ce00-000000000000"
  ],
  "ConditionalAccessPolicies": [
    {
      "id": "SecurityDefaults",
      "displayName": "Security Defaults",
      "enforcedGrantControls": [
        "Mfa"
      ],
      "result": "success",
      "conditionsSatisfied": 3,
      "conditionsNotSatisfied": 0
    }
  ],
  "ConditionalAccessStatus": "notApplied",
  "CorrelationId": "bdaead9d-757c-4d71-b6a1-79948aa7aeca",
  "CreatedDateTime": "2026-07-25T15:45:05.3446797Z",
  "CrossTenantAccessType": "none",
  "DeviceDetail": {
    "deviceId": "",
    "operatingSystem": "MacOs",
    "browser": "Firefox 152.0",
    "isCompliant": false,
    "isManaged": false
  },
  "DurationMs": "0",
  "FlaggedForReview": "None",
  "HomeTenantId": "11111111-1111-1111-1111-111111111111",
  "IPAddress": "2001:db8::10",
  "Id": "e1dfa18f-4e2e-4e4d-bca7-eff8263e2c00",
  "Identity": "Admin User",
  "IncomingTokenType": "none",
  "IsInteractive": "True",
  "IsRisky": "None",
  "IsTenantRestricted": "False",
  "IsThroughGlobalSecureAccess": "False",
  "Location": "US",
  "LocationDetails": {
    "city": "Redacted",
    "state": "Redacted",
    "countryOrRegion": "US",
    "geoCoordinates": {
      "latitude": 0.0,
      "longitude": 0.0
    }
  },
  "MfaDetail": "None",
  "OperationName": "Sign-in activity",
  "OperationVersion": "1.0",
  "OriginalRequestId": "e1dfa18f-4e2e-4e4d-bca7-eff8263e2c00",
  "OriginalTransferMethod": "none",
  "ProcessingTimeInMilliseconds": "107",
  "Resource": "Microsoft.aadiam",
  "ResourceDisplayName": "Windows Azure Active Directory",
  "ResourceGroup": "Microsoft.aadiam",
  "ResourceId": "/tenants/11111111-1111-1111-1111-111111111111/providers/Microsoft.aadiam",
  "ResourceIdentity": "00000002-0000-0000-c000-000000000000",
  "ResourceOwnerTenantId": "f8cdef31-a31e-4b4a-93e4-5f571e91255a",
  "ResourceServicePrincipalId": "32296670-c2e0-46c9-9094-e0149fb34fa3",
  "ResourceTenantId": "11111111-1111-1111-1111-111111111111",
  "ResultSignature": "SUCCESS",
  "ResultType": "0",
  "RiskDetail": "hidden",
  "RiskEventTypes": [],
  "RiskEventTypes_V2": [],
  "RiskLevelAggregated": "hidden",
  "RiskLevelDuringSignIn": "hidden",
  "RiskState": "none",
  "ServicePrincipalId": "a982479a-70f4-45cb-8790-6495238e4eed",
  "ServicePrincipalName": "Microsoft Office 365 Portal",
  "SessionId": "0022840a-e4ab-884c-587f-d20d24637227",
  "SessionLifetimePolicies": [],
  "Status": {
    "errorCode": 0,
    "additionalDetails": "MFA requirement satisfied by claim in the token"
  },
  "TokenIssuerType": "AzureAD",
  "TokenProtectionStatusDetails": {
    "signInSessionStatus": "unbound",
    "signInSessionStatusCode": 1002
  },
  "UniqueTokenIdentifier": "j6Hf4S5OTU68p-_4Jj4sAA",
  "UserAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:152.0) Gecko/20100101 Firefox/152.0",
  "UserDisplayName": "Admin User",
  "UserId": "aaaaaaaa-0000-0000-0000-000000000001",
  "UserPrincipalName": "adminuser@example.onmicrosoft.com",
  "UserType": "Member"
}

Common Indicators #

Field	Kind	Value	Rules	Vendors
`ResultType` (kusto rule field)	eq	`0`	3 rules	kusto
`RiskLevelAggregated` (kusto rule field)	eq	`high`	2 rules	kusto
`RiskLevelDuringSignIn` (kusto rule field)	eq	`high`	2 rules	kusto
`RiskState` (kusto rule field)	eq	`atRisk`	2 rules	kusto
`AccountObjectId` (kusto rule field)	is_not_null		1 rule	kusto
`DeviceAction` (kusto rule field)	ne	`Block`	1 rule	kusto
`DeviceProduct` (kusto rule field)	starts_with	`FireWall`	1 rule	kusto
`DeviceProduct` (kusto rule field)	starts_with	`FortiGate`	1 rule	kusto
`DeviceProduct` (kusto rule field)	starts_with	`NSSWeblog`	1 rule	kusto
`DeviceProduct` (kusto rule field)	starts_with	`PAN`	1 rule	kusto
`DeviceProduct` (kusto rule field)	starts_with	`URL`	1 rule	kusto
`DeviceProduct` (kusto rule field)	starts_with	`VPN`	1 rule	kusto
`DeviceVendor` (kusto rule field)	contains	`check point`	1 rule	kusto
`DeviceVendor` (kusto rule field)	contains	`fortinet`	1 rule	kusto
`DeviceVendor` (kusto rule field)	contains	`palo alto networks`	1 rule	kusto

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Suspicious SignIns From A Non Registered Device source high: Detects risky authentication from a non AD registered device without MFA being required.T1078↳ also matches Success: Successful sign-in, Authentication requirement: Sign-in recording an authentication requirement

Kusto #

Insider Risk_Risky User Access By Application source medium: This alert evaluates Microsoft Entra ID Sign in risk via Machine Learning correlations in the basket operator. The basket threshold is adjustable, and the default is set to .01. There is an optional configuration to configure the percentage rates. The correlations are designed to leverage machine learning to identify patterns of risky user application access. There is an option for configuration of correlations against Microsoft Sentinel watchlists. For more information, see Tutorial: Use risk detections for user sign-ins to trigger Microsoft Entra ID Multi-Factor Authentication or password changesT1204↳ also matches Target application: Sign-in naming a target application
Risky user signin observed in non-Microsoft network device source medium: This content is utilized to identify instances of successful login by risky users, who have been observed engaging in potentially suspicious network activity on non-Microsoft network devices.T1071↳ also matches Success: Successful sign-in
High-Risk Cross-Cloud User Impersonation source medium: This detection focuses on identifying high-risk cross-cloud activities and sign-in anomalies that may indicate potential security threats. The query starts by analyzing Microsoft Entra ID Signin Logs to pinpoint instances where specific applications, risk levels, and result types align. It then correlates this information with relevant AWS CloudTrail events to identify activities across Azure and AWS environments.T1078, T1078.002, T1078.004, T1134↳ also matches Target application: Sign-in naming a target application

Show 2 more (5 total) on the rules page

Target application: Sign-in naming a target application

Description

Record carrying AppDisplayName, AppId, or ResourceDisplayName: the application signed into and the OAuth resource (API) accessed. Rules hunt unexpected applications acquiring tokens for sensitive resources.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`AppDisplayName`	11 detection rules	Kusto, Splunk
`ResultType`	7 detection rules	Elastic, Kusto
`AppId`	4 detection rules	Kusto
`OriginalRequestId`	3 detection rules	Kusto
`ResourceDisplayName`	3 detection rules	Elastic, Kusto, Sigma
`Category`	2 detection rules	Elastic, Splunk
`Location`	2 detection rules	Kusto
`AuthenticationRequirement`	1 detection rule	Sigma
`ConditionalAccessStatus`	1 detection rule	Sigma
`IncomingTokenType`	1 detection rule	Kusto
`NetworkLocationDetails`	1 detection rule	Kusto
`ResourceIdentity`	1 detection rule	Kusto
`RiskEventTypes`	1 detection rule	Kusto
`RiskEventTypes_V2`	1 detection rule	Kusto
`RiskLevelAggregated`	1 detection rule	Kusto
`RiskLevelDuringSignIn`	1 detection rule	Kusto
`RiskState`	1 detection rule	Kusto
`SessionId`	1 detection rule	Kusto
`UserAgent`	1 detection rule	Elastic
`UserPrincipalName`	1 detection rule	Elastic
`UserType`	1 detection rule	Kusto

Example Sign-in Log Entry #

{
  "AADTenantId": "11111111-1111-1111-1111-111111111111",
  "Agent": {
    "agentType": "notAgentic",
    "agentSubjectType": "notAgentic"
  },
  "AppDisplayName": "Microsoft Office 365 Portal",
  "AppId": "00000006-0000-0ff1-ce00-000000000000",
  "AppOwnerTenantId": "f8cdef31-a31e-4b4a-93e4-5f571e91255a",
  "AppliedEventListeners": "None",
  "AuthenticationContextClassReferences": [],
  "AuthenticationDetails": [
    {
      "authenticationStepDateTime": "2026-07-25T15:45:05.3446797+00:00",
      "authenticationMethod": "Previously satisfied",
      "succeeded": true,
      "authenticationStepResultDetail": "First factor requirement satisfied by claim in the token",
      "authenticationStepRequirement": "",
      "StatusSequence": 0,
      "RequestSequence": 0
    },
    {
      "authenticationStepDateTime": "2026-07-25T15:45:05.3446797+00:00",
      "authenticationMethod": "Previously satisfied",
      "authenticationMethodDetail": "",
      "succeeded": true,
      "authenticationStepResultDetail": "MFA requirement satisfied by claim in the token",
      "authenticationStepRequirement": ""
    }
  ],
  "AuthenticationProcessingDetails": [
    {
      "key": "Is Client Capable",
      "value": "True"
    },
    {
      "key": "Legacy TLS (TLS 1.0, 1.1, 3DES)",
      "value": "False"
    },
    {
      "key": "Is Legacy Store Used",
      "value": "False"
    },
    {
      "key": "Is CAE Token",
      "value": "True"
    }
  ],
  "AuthenticationProtocol": "none",
  "AuthenticationRequirement": "multiFactorAuthentication",
  "AuthenticationRequirementPolicies": [
    {
      "requirementProvider": "securityDefaults",
      "detail": "Security Defaults"
    }
  ],
  "AutonomousSystemNumber": "64512",
  "Category": "SignInLogs",
  "ClientAppUsed": "Browser",
  "ClientCredentialType": "none",
  "ConditionalAccessAudiences": [
    "00000006-0000-0ff1-ce00-000000000000"
  ],
  "ConditionalAccessPolicies": [
    {
      "id": "SecurityDefaults",
      "displayName": "Security Defaults",
      "enforcedGrantControls": [
        "Mfa"
      ],
      "result": "success",
      "conditionsSatisfied": 3,
      "conditionsNotSatisfied": 0
    }
  ],
  "ConditionalAccessStatus": "notApplied",
  "CorrelationId": "bdaead9d-757c-4d71-b6a1-79948aa7aeca",
  "CreatedDateTime": "2026-07-25T15:45:05.3446797Z",
  "CrossTenantAccessType": "none",
  "DeviceDetail": {
    "deviceId": "",
    "operatingSystem": "MacOs",
    "browser": "Firefox 152.0",
    "isCompliant": false,
    "isManaged": false
  },
  "DurationMs": "0",
  "FlaggedForReview": "None",
  "HomeTenantId": "11111111-1111-1111-1111-111111111111",
  "IPAddress": "2001:db8::10",
  "Id": "e1dfa18f-4e2e-4e4d-bca7-eff8263e2c00",
  "Identity": "Admin User",
  "IncomingTokenType": "none",
  "IsInteractive": "True",
  "IsRisky": "None",
  "IsTenantRestricted": "False",
  "IsThroughGlobalSecureAccess": "False",
  "Location": "US",
  "LocationDetails": {
    "city": "Redacted",
    "state": "Redacted",
    "countryOrRegion": "US",
    "geoCoordinates": {
      "latitude": 0.0,
      "longitude": 0.0
    }
  },
  "MfaDetail": "None",
  "OperationName": "Sign-in activity",
  "OperationVersion": "1.0",
  "OriginalRequestId": "e1dfa18f-4e2e-4e4d-bca7-eff8263e2c00",
  "OriginalTransferMethod": "none",
  "ProcessingTimeInMilliseconds": "107",
  "Resource": "Microsoft.aadiam",
  "ResourceDisplayName": "Windows Azure Active Directory",
  "ResourceGroup": "Microsoft.aadiam",
  "ResourceId": "/tenants/11111111-1111-1111-1111-111111111111/providers/Microsoft.aadiam",
  "ResourceIdentity": "00000002-0000-0000-c000-000000000000",
  "ResourceOwnerTenantId": "f8cdef31-a31e-4b4a-93e4-5f571e91255a",
  "ResourceServicePrincipalId": "32296670-c2e0-46c9-9094-e0149fb34fa3",
  "ResourceTenantId": "11111111-1111-1111-1111-111111111111",
  "ResultSignature": "SUCCESS",
  "ResultType": "0",
  "RiskDetail": "hidden",
  "RiskEventTypes": [],
  "RiskEventTypes_V2": [],
  "RiskLevelAggregated": "hidden",
  "RiskLevelDuringSignIn": "hidden",
  "RiskState": "none",
  "ServicePrincipalId": "a982479a-70f4-45cb-8790-6495238e4eed",
  "ServicePrincipalName": "Microsoft Office 365 Portal",
  "SessionId": "0022840a-e4ab-884c-587f-d20d24637227",
  "SessionLifetimePolicies": [],
  "Status": {
    "errorCode": 0,
    "additionalDetails": "MFA requirement satisfied by claim in the token"
  },
  "TokenIssuerType": "AzureAD",
  "TokenProtectionStatusDetails": {
    "signInSessionStatus": "unbound",
    "signInSessionStatusCode": 1002
  },
  "UniqueTokenIdentifier": "j6Hf4S5OTU68p-_4Jj4sAA",
  "UserAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:152.0) Gecko/20100101 Firefox/152.0",
  "UserDisplayName": "Admin User",
  "UserId": "aaaaaaaa-0000-0000-0000-000000000001",
  "UserPrincipalName": "adminuser@example.onmicrosoft.com",
  "UserType": "Member"
}

Common Indicators #

Field	Kind	Value	Rules	Vendors
`OriginalRequestId` (kusto rule field)	is_not_null		3 rules	kusto
`ResultType` (kusto rule field)	eq	`0`	3 rules	kusto
`ResultType` (kusto rule field)	in	`0`	1 rule	kusto
`AppDisplayName` (kusto rule field)	eq	`Azure Portal`	2 rules	kusto
`AIPCall` (kusto rule field)	contains	`name`	1 rule	kusto
`ActivityType` (kusto rule field)	contains	`credentialaccess:rds/anomalousbehavior.successfulbruteforce`	1 rule	kusto
`ActivityType` (kusto rule field)	contains	`credentialaccess:rds/toripcaller.failedlogin`	1 rule	kusto
`ActivityType` (kusto rule field)	contains	`credentialaccess:rds/toripcaller.successfullogin`	1 rule	kusto
`ActivityType` (kusto rule field)	contains	`unauthorizedaccess:iamuser/consoleloginsuccess.b`	1 rule	kusto
`ActivityType` (kusto rule field)	contains	`unauthorizedaccess:iamuser/instancecredentialexfiltration.insideaws`	1 rule	kusto
`ActivityType` (kusto rule field)	contains	`unauthorizedaccess:iamuser/instancecredentialexfiltration.outsideaws`	1 rule	kusto
`ActivityType` (kusto rule field)	contains	`unauthorizedaccess:iamuser/maliciousipcaller.custom`	1 rule	kusto
`ActivityType` (kusto rule field)	contains	`unauthorizedaccess:iamuser/toripcaller`	1 rule	kusto
`HomeTenantId` (kusto rule field)	cross_field_compare	`ResourceTenantId`	1 rule	kusto
`Message` (kusto rule field)	eq	`UserSignIn`	1 rule	kusto

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Device Registration or Join Without MFA source medium: Monitor and alert for device registration or join events where MFA was not performed.T1078, T1078.004↳ also matches Conditional Access status: Sign-in recording a Conditional Access status

Elastic #

Entra ID Sign-in Brute Force Attempted (Microsoft 365) source medium: Identifies potential brute-force attacks targeting Microsoft 365 user accounts by analyzing failed sign-in patterns in Microsoft Entra ID Sign-In Logs. This detection focuses on a high volume of failed interactive or non-interactive authentication attempts within a short time window, often indicative of password spraying, credential stuffing, or password guessing. Adversaries may use these techniques to gain unauthorized access to Microsoft 365 services such as Exchange Online, SharePoint, or Teams.T1110, T1110.001, T1110.003, T1110.004↳ also matches Invalid-credentials: Sign-in with invalid credentials, Password-expired: Sign-in blocked by expired password, Disabled: Sign-in attempted against a disabled account, MFA-challenged: Sign-in with an incomplete or failed MFA challenge, Other: Sign-in with another recorded result

Splunk #

Azure AD Successful PowerShell Authentication source: The following analytic identifies a successful authentication event against an Azure AD tenant using PowerShell cmdlets. This detection leverages Azure AD SignInLogs to identify successful logins where the appDisplayName is "Microsoft…T1078, T1078.004, T1586, T1586.003↳ also matches Success: Successful sign-in

Kusto #

Power Platform - Possibly compromised user accesses Power Platform services source high: Identifies user accounts flagged at risk in Microsoft Entra Identity Protection and correlates these users with sign-in activity in Power Platform, including Power Apps, Power Automate and Power Platform Admin Center.T1078, T1210
Brute force attack against an Entra-authenticated Windows device source medium: Identifies evidence of brute force activity against Windows devices authenticated via Entra ID (including Entra-joined, hybrid-joined, and Windows 365 Cloud PCs) by detecting multiple authentication failures followed by a successful authentication within a defined time window.T1110
Cross-Cloud Password Spray detection source medium: This detection focuses on identifying potential cross-cloud brute force / Password Spray attempts involving Azure and AWS platforms. It monitors sign-in activities within the Azure Portal and AWS ConsoleLogins where brute force attempts are successful on both platforms in a synchronized manner.T1110

Show 13 more (16 total) on the rules page

Authentication requirement: Sign-in recording an authentication requirement

Description

Record carrying AuthenticationRequirement (multiFactorAuthentication or singleFactorAuthentication): the policy-required authentication level for the sign-in, not whether MFA succeeded.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`AuthenticationRequirement`	10 detection rules	Elastic, Kusto, Sigma, Splunk
`Category`	4 detection rules	Elastic, Splunk
`ResultType`	4 detection rules	Elastic, Kusto, Sigma
`Status`	3 detection rules	Sigma
`UserPrincipalName`	2 detection rules	Elastic
`AutonomousSystemNumber`	1 detection rule	Kusto
`NetworkLocationDetails`	1 detection rule	Sigma
`OperationName`	1 detection rule	Splunk
`RiskState`	1 detection rule	Sigma
`UserAgent`	1 detection rule	Elastic

Example Sign-in Log Entry #

{
  "AADTenantId": "11111111-1111-1111-1111-111111111111",
  "Agent": {
    "agentType": "notAgentic",
    "agentSubjectType": "notAgentic"
  },
  "AppDisplayName": "Microsoft Office 365 Portal",
  "AppId": "00000006-0000-0ff1-ce00-000000000000",
  "AppOwnerTenantId": "f8cdef31-a31e-4b4a-93e4-5f571e91255a",
  "AppliedEventListeners": "None",
  "AuthenticationContextClassReferences": [],
  "AuthenticationDetails": [
    {
      "authenticationStepDateTime": "2026-07-25T15:45:05.3446797+00:00",
      "authenticationMethod": "Previously satisfied",
      "succeeded": true,
      "authenticationStepResultDetail": "First factor requirement satisfied by claim in the token",
      "authenticationStepRequirement": "",
      "StatusSequence": 0,
      "RequestSequence": 0
    },
    {
      "authenticationStepDateTime": "2026-07-25T15:45:05.3446797+00:00",
      "authenticationMethod": "Previously satisfied",
      "authenticationMethodDetail": "",
      "succeeded": true,
      "authenticationStepResultDetail": "MFA requirement satisfied by claim in the token",
      "authenticationStepRequirement": ""
    }
  ],
  "AuthenticationProcessingDetails": [
    {
      "key": "Is Client Capable",
      "value": "True"
    },
    {
      "key": "Legacy TLS (TLS 1.0, 1.1, 3DES)",
      "value": "False"
    },
    {
      "key": "Is Legacy Store Used",
      "value": "False"
    },
    {
      "key": "Is CAE Token",
      "value": "True"
    }
  ],
  "AuthenticationProtocol": "none",
  "AuthenticationRequirement": "multiFactorAuthentication",
  "AuthenticationRequirementPolicies": [
    {
      "requirementProvider": "securityDefaults",
      "detail": "Security Defaults"
    }
  ],
  "AutonomousSystemNumber": "64512",
  "Category": "SignInLogs",
  "ClientAppUsed": "Browser",
  "ClientCredentialType": "none",
  "ConditionalAccessAudiences": [
    "00000006-0000-0ff1-ce00-000000000000"
  ],
  "ConditionalAccessPolicies": [
    {
      "id": "SecurityDefaults",
      "displayName": "Security Defaults",
      "enforcedGrantControls": [
        "Mfa"
      ],
      "result": "success",
      "conditionsSatisfied": 3,
      "conditionsNotSatisfied": 0
    }
  ],
  "ConditionalAccessStatus": "notApplied",
  "CorrelationId": "bdaead9d-757c-4d71-b6a1-79948aa7aeca",
  "CreatedDateTime": "2026-07-25T15:45:05.3446797Z",
  "CrossTenantAccessType": "none",
  "DeviceDetail": {
    "deviceId": "",
    "operatingSystem": "MacOs",
    "browser": "Firefox 152.0",
    "isCompliant": false,
    "isManaged": false
  },
  "DurationMs": "0",
  "FlaggedForReview": "None",
  "HomeTenantId": "11111111-1111-1111-1111-111111111111",
  "IPAddress": "2001:db8::10",
  "Id": "e1dfa18f-4e2e-4e4d-bca7-eff8263e2c00",
  "Identity": "Admin User",
  "IncomingTokenType": "none",
  "IsInteractive": "True",
  "IsRisky": "None",
  "IsTenantRestricted": "False",
  "IsThroughGlobalSecureAccess": "False",
  "Location": "US",
  "LocationDetails": {
    "city": "Redacted",
    "state": "Redacted",
    "countryOrRegion": "US",
    "geoCoordinates": {
      "latitude": 0.0,
      "longitude": 0.0
    }
  },
  "MfaDetail": "None",
  "OperationName": "Sign-in activity",
  "OperationVersion": "1.0",
  "OriginalRequestId": "e1dfa18f-4e2e-4e4d-bca7-eff8263e2c00",
  "OriginalTransferMethod": "none",
  "ProcessingTimeInMilliseconds": "107",
  "Resource": "Microsoft.aadiam",
  "ResourceDisplayName": "Windows Azure Active Directory",
  "ResourceGroup": "Microsoft.aadiam",
  "ResourceId": "/tenants/11111111-1111-1111-1111-111111111111/providers/Microsoft.aadiam",
  "ResourceIdentity": "00000002-0000-0000-c000-000000000000",
  "ResourceOwnerTenantId": "f8cdef31-a31e-4b4a-93e4-5f571e91255a",
  "ResourceServicePrincipalId": "32296670-c2e0-46c9-9094-e0149fb34fa3",
  "ResourceTenantId": "11111111-1111-1111-1111-111111111111",
  "ResultSignature": "SUCCESS",
  "ResultType": "0",
  "RiskDetail": "hidden",
  "RiskEventTypes": [],
  "RiskEventTypes_V2": [],
  "RiskLevelAggregated": "hidden",
  "RiskLevelDuringSignIn": "hidden",
  "RiskState": "none",
  "ServicePrincipalId": "a982479a-70f4-45cb-8790-6495238e4eed",
  "ServicePrincipalName": "Microsoft Office 365 Portal",
  "SessionId": "0022840a-e4ab-884c-587f-d20d24637227",
  "SessionLifetimePolicies": [],
  "Status": {
    "errorCode": 0,
    "additionalDetails": "MFA requirement satisfied by claim in the token"
  },
  "TokenIssuerType": "AzureAD",
  "TokenProtectionStatusDetails": {
    "signInSessionStatus": "unbound",
    "signInSessionStatusCode": 1002
  },
  "UniqueTokenIdentifier": "j6Hf4S5OTU68p-_4Jj4sAA",
  "UserAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:152.0) Gecko/20100101 Firefox/152.0",
  "UserDisplayName": "Admin User",
  "UserId": "aaaaaaaa-0000-0000-0000-000000000001",
  "UserPrincipalName": "adminuser@example.onmicrosoft.com",
  "UserType": "Member"
}

Common Indicators #

Field	Kind	Value	Rules	Vendors
`azure_ad::authentication_requirement`	eq	`singlefactorauthentication`	5 rules	elastic, sigma
`ResultType`	eq	`0`	2 rules	kusto, sigma
`Status` (sigma rule field)	eq	`success`	2 rules	sigma
`category` (splunk rule field)	eq	`signinlogs`	2 rules	splunk
`properties.authenticationDetails{}.succeeded` (splunk rule field)	eq	`true`	2 rules	splunk
`properties.authenticationRequirement` (splunk rule field)	eq	`singlefactorauthentication`	2 rules	splunk
`count` (splunk rule field)	gt	`5`	1 rule	splunk
`unique_app_ids` (splunk rule field)	gt	`2`	1 rule	splunk
`unique_user_agents` (splunk rule field)	gt	`5`	1 rule	splunk

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Multifactor Authentication Denied source medium: User has indicated they haven't instigated the MFA prompt and could indicate an attacker has the password for the account.T1078, T1078.004, T1110, T1621
Azure AD Only Single Factor Authentication Required source low: Detect when users are authenticating without MFA being required.T1078, T1078.004, T1556, T1556.006↳ also matches Success: Successful sign-in
Suspicious SignIns From A Non Registered Device source high: Detects risky authentication from a non AD registered device without MFA being required.T1078↳ also matches Success: Successful sign-in, Identity Protection (risk): Sign-in with an Identity Protection risk assessment

Show 1 more (4 total) on the rules page

Elastic #

Entra ID User Sign-in Brute Force Attempted source medium: Identifies potential brute-force attacks targeting user accounts by analyzing failed sign-in patterns in Microsoft Entra ID Sign-In Logs. This detection focuses on a high volume of failed interactive or non-interactive authentication attempts within a short time window, often indicative of password spraying, credential stuffing, or password guessing. Adversaries may use these techniques to gain unauthorized access to applications integrated with Entra ID or to compromise valid user accounts.T1110, T1110.001, T1110.003, T1110.004↳ also matches Invalid-credentials: Sign-in with invalid credentials, Password-expired: Sign-in blocked by expired password, Disabled: Sign-in attempted against a disabled account, MFA-challenged: Sign-in with an incomplete or failed MFA challenge, Other: Sign-in with another recorded result
Entra ID Excessive Account Lockouts Detected source high: Identifies a high count of failed Microsoft Entra ID sign-in attempts as the result of the target user account being locked out. Adversaries may attempt to brute-force user accounts by repeatedly trying to authenticate with incorrect credentials, leading to account lockouts by Entra ID Smart Lockout policies.T1110, T1110.001, T1110.003, T1110.004↳ also matches Account-locked: Sign-in blocked by account lockout

Splunk #

Azure AD Multiple AppIDs and UserAgents Authentication Spike source: The following analytic detects unusual authentication activity in Azure AD, specifically when a single user account has over 8 authentication attempts using 3+ unique application IDs and 5+ unique user agents within a short period. It…T1078↳ also matches Success: Successful sign-in
Azure AD Successful Single-Factor Authentication source: The following analytic identifies a successful single-factor authentication event against Azure Active Directory. It leverages Azure SignInLogs data, specifically focusing on events where single-factor authentication succeeded. This…T1078, T1078.004, T1586, T1586.003↳ also matches Success: Successful sign-in

Kusto #

MFA Spamming followed by Successful login source high: Identifies MFA Spamming followed by Successful logins and by a successful authentication within a given time window. Default Failure count is 10 and 1 successful login with default Time Window is 5 minutes.T1110
Anomalous Single Factor Signin source low: Detects successful signins using single factor authentication where the device, location, and ASN are abnormal. Single factor authentications pose an opportunity to access compromised accounts, investigate these for anomalous occurrencess. Ref: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-devices#non-compliant-device-sign-inT1078, T1078.004↳ also matches Success: Successful sign-in

Conditional Access status: Sign-in recording a Conditional Access status

Description

Record carrying ConditionalAccessStatus (success, failure, or notApplied): whether a Conditional Access policy applied to the sign-in.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`AuthenticationRequirement`	1 detection rule	Sigma
`ConditionalAccessStatus`	1 detection rule	Sigma
`ResourceDisplayName`	1 detection rule	Sigma

Example Sign-in Log Entry #

{
  "AADTenantId": "11111111-1111-1111-1111-111111111111",
  "Agent": {
    "agentType": "notAgentic",
    "agentSubjectType": "notAgentic"
  },
  "AppDisplayName": "Microsoft Office 365 Portal",
  "AppId": "00000006-0000-0ff1-ce00-000000000000",
  "AppOwnerTenantId": "f8cdef31-a31e-4b4a-93e4-5f571e91255a",
  "AppliedEventListeners": "None",
  "AuthenticationContextClassReferences": [],
  "AuthenticationDetails": [
    {
      "authenticationStepDateTime": "2026-07-25T15:45:05.3446797+00:00",
      "authenticationMethod": "Previously satisfied",
      "succeeded": true,
      "authenticationStepResultDetail": "First factor requirement satisfied by claim in the token",
      "authenticationStepRequirement": "",
      "StatusSequence": 0,
      "RequestSequence": 0
    },
    {
      "authenticationStepDateTime": "2026-07-25T15:45:05.3446797+00:00",
      "authenticationMethod": "Previously satisfied",
      "authenticationMethodDetail": "",
      "succeeded": true,
      "authenticationStepResultDetail": "MFA requirement satisfied by claim in the token",
      "authenticationStepRequirement": ""
    }
  ],
  "AuthenticationProcessingDetails": [
    {
      "key": "Is Client Capable",
      "value": "True"
    },
    {
      "key": "Legacy TLS (TLS 1.0, 1.1, 3DES)",
      "value": "False"
    },
    {
      "key": "Is Legacy Store Used",
      "value": "False"
    },
    {
      "key": "Is CAE Token",
      "value": "True"
    }
  ],
  "AuthenticationProtocol": "none",
  "AuthenticationRequirement": "multiFactorAuthentication",
  "AuthenticationRequirementPolicies": [
    {
      "requirementProvider": "securityDefaults",
      "detail": "Security Defaults"
    }
  ],
  "AutonomousSystemNumber": "64512",
  "Category": "SignInLogs",
  "ClientAppUsed": "Browser",
  "ClientCredentialType": "none",
  "ConditionalAccessAudiences": [
    "00000006-0000-0ff1-ce00-000000000000"
  ],
  "ConditionalAccessPolicies": [
    {
      "id": "SecurityDefaults",
      "displayName": "Security Defaults",
      "enforcedGrantControls": [
        "Mfa"
      ],
      "result": "success",
      "conditionsSatisfied": 3,
      "conditionsNotSatisfied": 0
    }
  ],
  "ConditionalAccessStatus": "notApplied",
  "CorrelationId": "bdaead9d-757c-4d71-b6a1-79948aa7aeca",
  "CreatedDateTime": "2026-07-25T15:45:05.3446797Z",
  "CrossTenantAccessType": "none",
  "DeviceDetail": {
    "deviceId": "",
    "operatingSystem": "MacOs",
    "browser": "Firefox 152.0",
    "isCompliant": false,
    "isManaged": false
  },
  "DurationMs": "0",
  "FlaggedForReview": "None",
  "HomeTenantId": "11111111-1111-1111-1111-111111111111",
  "IPAddress": "2001:db8::10",
  "Id": "e1dfa18f-4e2e-4e4d-bca7-eff8263e2c00",
  "Identity": "Admin User",
  "IncomingTokenType": "none",
  "IsInteractive": "True",
  "IsRisky": "None",
  "IsTenantRestricted": "False",
  "IsThroughGlobalSecureAccess": "False",
  "Location": "US",
  "LocationDetails": {
    "city": "Redacted",
    "state": "Redacted",
    "countryOrRegion": "US",
    "geoCoordinates": {
      "latitude": 0.0,
      "longitude": 0.0
    }
  },
  "MfaDetail": "None",
  "OperationName": "Sign-in activity",
  "OperationVersion": "1.0",
  "OriginalRequestId": "e1dfa18f-4e2e-4e4d-bca7-eff8263e2c00",
  "OriginalTransferMethod": "none",
  "ProcessingTimeInMilliseconds": "107",
  "Resource": "Microsoft.aadiam",
  "ResourceDisplayName": "Windows Azure Active Directory",
  "ResourceGroup": "Microsoft.aadiam",
  "ResourceId": "/tenants/11111111-1111-1111-1111-111111111111/providers/Microsoft.aadiam",
  "ResourceIdentity": "00000002-0000-0000-c000-000000000000",
  "ResourceOwnerTenantId": "f8cdef31-a31e-4b4a-93e4-5f571e91255a",
  "ResourceServicePrincipalId": "32296670-c2e0-46c9-9094-e0149fb34fa3",
  "ResourceTenantId": "11111111-1111-1111-1111-111111111111",
  "ResultSignature": "SUCCESS",
  "ResultType": "0",
  "RiskDetail": "hidden",
  "RiskEventTypes": [],
  "RiskEventTypes_V2": [],
  "RiskLevelAggregated": "hidden",
  "RiskLevelDuringSignIn": "hidden",
  "RiskState": "none",
  "ServicePrincipalId": "a982479a-70f4-45cb-8790-6495238e4eed",
  "ServicePrincipalName": "Microsoft Office 365 Portal",
  "SessionId": "0022840a-e4ab-884c-587f-d20d24637227",
  "SessionLifetimePolicies": [],
  "Status": {
    "errorCode": 0,
    "additionalDetails": "MFA requirement satisfied by claim in the token"
  },
  "TokenIssuerType": "AzureAD",
  "TokenProtectionStatusDetails": {
    "signInSessionStatus": "unbound",
    "signInSessionStatusCode": 1002
  },
  "UniqueTokenIdentifier": "j6Hf4S5OTU68p-_4Jj4sAA",
  "UserAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:152.0) Gecko/20100101 Firefox/152.0",
  "UserDisplayName": "Admin User",
  "UserId": "aaaaaaaa-0000-0000-0000-000000000001",
  "UserPrincipalName": "adminuser@example.onmicrosoft.com",
  "UserType": "Member"
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Device Registration or Join Without MFA source medium: Monitor and alert for device registration or join events where MFA was not performed.T1078, T1078.004↳ also matches Target application: Sign-in naming a target application

Client app (legacy authentication): Sign-in from a named client app (legacy authentication signal)

Description

Record carrying ClientAppUsed. Legacy authentication clients report values such as Other clients, IMAP, POP3, SMTP, Mapi, AutoDiscover, and Exchange ActiveSync; modern clients report Browser or Mobile Apps and Desktop Clients.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`ClientAppUsed`	1 detection rule	Sigma

Example Sign-in Log Entry #

{
  "AADTenantId": "11111111-1111-1111-1111-111111111111",
  "Agent": {
    "agentType": "notAgentic",
    "agentSubjectType": "notAgentic"
  },
  "AppDisplayName": "Microsoft Office 365 Portal",
  "AppId": "00000006-0000-0ff1-ce00-000000000000",
  "AppOwnerTenantId": "f8cdef31-a31e-4b4a-93e4-5f571e91255a",
  "AppliedEventListeners": "None",
  "AuthenticationContextClassReferences": [],
  "AuthenticationDetails": [
    {
      "authenticationStepDateTime": "2026-07-25T15:45:05.3446797+00:00",
      "authenticationMethod": "Previously satisfied",
      "succeeded": true,
      "authenticationStepResultDetail": "First factor requirement satisfied by claim in the token",
      "authenticationStepRequirement": "",
      "StatusSequence": 0,
      "RequestSequence": 0
    },
    {
      "authenticationStepDateTime": "2026-07-25T15:45:05.3446797+00:00",
      "authenticationMethod": "Previously satisfied",
      "authenticationMethodDetail": "",
      "succeeded": true,
      "authenticationStepResultDetail": "MFA requirement satisfied by claim in the token",
      "authenticationStepRequirement": ""
    }
  ],
  "AuthenticationProcessingDetails": [
    {
      "key": "Is Client Capable",
      "value": "True"
    },
    {
      "key": "Legacy TLS (TLS 1.0, 1.1, 3DES)",
      "value": "False"
    },
    {
      "key": "Is Legacy Store Used",
      "value": "False"
    },
    {
      "key": "Is CAE Token",
      "value": "True"
    }
  ],
  "AuthenticationProtocol": "none",
  "AuthenticationRequirement": "multiFactorAuthentication",
  "AuthenticationRequirementPolicies": [
    {
      "requirementProvider": "securityDefaults",
      "detail": "Security Defaults"
    }
  ],
  "AutonomousSystemNumber": "64512",
  "Category": "SignInLogs",
  "ClientAppUsed": "Browser",
  "ClientCredentialType": "none",
  "ConditionalAccessAudiences": [
    "00000006-0000-0ff1-ce00-000000000000"
  ],
  "ConditionalAccessPolicies": [
    {
      "id": "SecurityDefaults",
      "displayName": "Security Defaults",
      "enforcedGrantControls": [
        "Mfa"
      ],
      "result": "success",
      "conditionsSatisfied": 3,
      "conditionsNotSatisfied": 0
    }
  ],
  "ConditionalAccessStatus": "notApplied",
  "CorrelationId": "bdaead9d-757c-4d71-b6a1-79948aa7aeca",
  "CreatedDateTime": "2026-07-25T15:45:05.3446797Z",
  "CrossTenantAccessType": "none",
  "DeviceDetail": {
    "deviceId": "",
    "operatingSystem": "MacOs",
    "browser": "Firefox 152.0",
    "isCompliant": false,
    "isManaged": false
  },
  "DurationMs": "0",
  "FlaggedForReview": "None",
  "HomeTenantId": "11111111-1111-1111-1111-111111111111",
  "IPAddress": "2001:db8::10",
  "Id": "e1dfa18f-4e2e-4e4d-bca7-eff8263e2c00",
  "Identity": "Admin User",
  "IncomingTokenType": "none",
  "IsInteractive": "True",
  "IsRisky": "None",
  "IsTenantRestricted": "False",
  "IsThroughGlobalSecureAccess": "False",
  "Location": "US",
  "LocationDetails": {
    "city": "Redacted",
    "state": "Redacted",
    "countryOrRegion": "US",
    "geoCoordinates": {
      "latitude": 0.0,
      "longitude": 0.0
    }
  },
  "MfaDetail": "None",
  "OperationName": "Sign-in activity",
  "OperationVersion": "1.0",
  "OriginalRequestId": "e1dfa18f-4e2e-4e4d-bca7-eff8263e2c00",
  "OriginalTransferMethod": "none",
  "ProcessingTimeInMilliseconds": "107",
  "Resource": "Microsoft.aadiam",
  "ResourceDisplayName": "Windows Azure Active Directory",
  "ResourceGroup": "Microsoft.aadiam",
  "ResourceId": "/tenants/11111111-1111-1111-1111-111111111111/providers/Microsoft.aadiam",
  "ResourceIdentity": "00000002-0000-0000-c000-000000000000",
  "ResourceOwnerTenantId": "f8cdef31-a31e-4b4a-93e4-5f571e91255a",
  "ResourceServicePrincipalId": "32296670-c2e0-46c9-9094-e0149fb34fa3",
  "ResourceTenantId": "11111111-1111-1111-1111-111111111111",
  "ResultSignature": "SUCCESS",
  "ResultType": "0",
  "RiskDetail": "hidden",
  "RiskEventTypes": [],
  "RiskEventTypes_V2": [],
  "RiskLevelAggregated": "hidden",
  "RiskLevelDuringSignIn": "hidden",
  "RiskState": "none",
  "ServicePrincipalId": "a982479a-70f4-45cb-8790-6495238e4eed",
  "ServicePrincipalName": "Microsoft Office 365 Portal",
  "SessionId": "0022840a-e4ab-884c-587f-d20d24637227",
  "SessionLifetimePolicies": [],
  "Status": {
    "errorCode": 0,
    "additionalDetails": "MFA requirement satisfied by claim in the token"
  },
  "TokenIssuerType": "AzureAD",
  "TokenProtectionStatusDetails": {
    "signInSessionStatus": "unbound",
    "signInSessionStatusCode": 1002
  },
  "UniqueTokenIdentifier": "j6Hf4S5OTU68p-_4Jj4sAA",
  "UserAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:152.0) Gecko/20100101 Firefox/152.0",
  "UserDisplayName": "Admin User",
  "UserId": "aaaaaaaa-0000-0000-0000-000000000001",
  "UserPrincipalName": "adminuser@example.onmicrosoft.com",
  "UserType": "Member"
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Use of Legacy Authentication Protocols source high: Alert on when legacy authentication has been used on an accountT1078, T1078.004, T1110

Sign-in Logs

any: Sign-in record (SigninLogs, any result)

Description

Detection Fields #

Example Sign-in Log Entry #

Common Indicators #

Related events #

Detection Rules #

Sigma #

Elastic #

Splunk #

Kusto #

YARA-L #

Panther #

Success: Successful sign-in

Description

Detection Fields #

Example Sign-in Log Entry #

Common Indicators #

Related events #

Detection Rules #

Sigma #

Elastic #

Splunk #

Kusto #

Invalid-credentials: Sign-in with invalid credentials

Description

Detection Fields #

Example Sign-in Log Entry #

Common Indicators #

Related events #

Detection Rules #

Elastic #

Splunk #

Account-locked: Sign-in blocked by account lockout

Description

Detection Fields #

Related events #

Detection Rules #

Sigma #

Elastic #

Password-expired: Sign-in blocked by expired password

Description

Detection Fields #

Common Indicators #

Related events #

Detection Rules #

Elastic #

Disabled: Sign-in attempted against a disabled account

Description

Detection Fields #

Common Indicators #

Related events #

Detection Rules #

Sigma #

Elastic #

Kusto #

MFA-challenged: Sign-in with an incomplete or failed MFA challenge

Description

Detection Fields #

Common Indicators #

Related events #

Detection Rules #

Sigma #

Elastic #

Splunk #

Kusto #

Blocked-by-CA: Sign-in blocked by Conditional Access

Description

Detection Fields #

Common Indicators #

Related events #

Detection Rules #

Sigma #

Other: Sign-in with another recorded result

Description

Detection Fields #

Example Sign-in Log Entry #

Common Indicators #

Related events #