Loading

External Authentication Method Addition or Modification in Entra ID

Identifies when an external authentication method (EAM) is added or modified in Entra ID. EAM may allow adversaries to bypass multi-factor authentication (MFA) requirements, potentially leading to unauthorized access to user accounts and sensitive resources by using bring-your-own IdP (BYOIDP) methods.

Rule type: new_terms
Rule indices:

  • filebeat-*
  • logs-azure.graphactivitylogs-*

Rule Severity: medium
Risk Score: 47
Runs every:
Searches indices from: now-9m
Maximum alerts per execution: ?
References:

Tags:

  • Domain: Cloud
  • Domain: Identity
  • Data Source: Azure
  • Data Source: Microsoft Graph
  • Data Source: Microsoft Graph Activity Logs
  • Use Case: Identity and Access Audit
  • Resources: Investigation Guide
  • Tactic: Persistence

Version: ?
Rule authors:

  • Elastic

Rule license: Elastic License v2

This rule detects suspicious modifications to external authentication methods (EAMs) in Microsoft Entra ID via Microsoft Graph API. Adversaries may abuse this capability to bypass multi-factor authentication (MFA), enabling persistence or unauthorized access through bring-your-own identity provider (BYOIDP) methods.

  • Validate that event.action is "Microsoft Graph Activity" and that http.request.method is "PATCH", indicating a configuration change was made.
  • Confirm that url.path contains the string authenticationMethodsPolicy, which is associated with external authentication settings in Entra ID.
  • Review user.id to identify the Azure AD object ID of the user or service principal that initiated the change.
  • Examine azure.graphactivitylogs.properties.app_id to determine the application ID that performed the action.
  • Analyze azure.graphactivitylogs.properties.scopes[] to assess whether the request used privileged scopes such as AuthenticationMethod.ReadWrite.All.
  • Review the geographic origin of the request using source.geo.* and the source.ip field to identify anomalous locations.
  • Examine user_agent.original to determine whether the request was made through a browser or automation (e.g., scripted activity).
  • Correlate azure.graphactivitylogs.properties.token_issued_at and azure.graphactivitylogs.properties.time_generated to assess whether the change occurred shortly after token issuance.
  • Investigate additional activity by the same user.id or app_id within a short timeframe (e.g., 30 minutes) to detect related suspicious behavior.
  • Use the operation_id or correlation_id to pivot across related Graph API or Entra ID activity logs, if available.
  • Legitimate administrative activity may trigger this rule, such as configuring FIDO2 or enabling passwordless sign-in methods during onboarding or security upgrades.
  • Some enterprise integrations or federated identity providers may programmatically update EAM settings as part of legitimate operations.
  • Routine security assessments or red team exercises may include changes to authentication policies. Validate with internal teams when in doubt.
  • If appropriate, filter or suppress alerts originating from known trusted service principals or administrative accounts.
  • Confirm whether the user or application that made the change was authorized to do so. If not, immediately revoke access and reset credentials as needed.
  • Review the application or automation that triggered the change to ensure it is legitimate. If unauthorized, disable or remove it and rotate secrets or tokens it may have accessed.
  • Audit current external authentication configurations and conditional access policies to ensure no persistent backdoors were introduced.
  • Revoke session tokens associated with the change using Entra ID's portal or Microsoft Graph API, and enforce reauthentication where appropriate.
  • Implement stricter RBAC or conditional access policies to prevent unauthorized EAM changes in the future.
  • Monitor for repeat or similar activity from the same source or identity as part of an ongoing compromise assessment.
event.dataset: azure.graphactivitylogs and
    url.path: *authenticationMethodsPolicy* and
    http.request.method: "PATCH" and
    http.response.status_code: 200

Framework: MITRE ATT&CK