Detection Pack Microsoft Entra ID

Entra ID Detection Pack

61 detection rules for Microsoft Entra ID — covering MFA abuse, Identity Protection risk events, Conditional Access bypass, OAuth consent phishing, and privileged role manipulation. The identity layer is the primary breach vector.

Activate this pack Entra ID integration docs

Pack summary

Detection rules: 61
Critical severity: 17
Log sources: 5
ATT&CK techniques: 20

What's included

61 rules across 5 threat categories for Entra ID identity threats.

Authentication & MFA Threats 20 rules

MFA fraud alerts, impossible travel, brute force, sign-in risk events, token replay.

Privileged Access Abuse 15 rules

Global admin assignment, PIM role activation anomalies, directory sync account abuse.

OAuth & Application Threats 12 rules

Consent phishing, service principal credential addition, app registration abuse.

Conditional Access & Policy Tampering 8 rules

CA policy deletion, named location exclusions, SSPR disabling, federation trust addition.

Identity Protection Signals 6 rules

High user risk, high sign-in risk, leaked credentials, anonymised IP address detections.

Detection rules (20 of 61 shown)

Showing 20 representative rules. All 61 rules activate with one click.

Rule name	Description	Severity	ATT&CK	Source
Entra ID MFA Fraud Alert Submitted	User submitted fraud alert during MFA push — active MFA fatigue attack.	Critical	T1621	Sign-In Log
Entra ID Global Administrator Role Assigned	Global Administrator granted — highest privilege role in Microsoft 365.	Critical	T1098.003	Audit Log
Entra ID Conditional Access Policy Disabled	CA policy disabled — may remove MFA or device compliance requirements.	Critical	T1556.006	Audit Log
Entra ID Sign-In Risk Detected — High	Microsoft Identity Protection raises high-risk sign-in event.	Critical	T1078	Sign-In Log
Entra ID User Risk Detected — High	Microsoft Identity Protection raises high user risk — potential account compromise.	Critical	T1078	Audit Log
Entra ID Privileged Identity Management Role Activation Outside Business Hours	Eligible privileged role activated outside normal hours — suspicious just-in-time use.	High	T1098.003	Audit Log
Entra ID Application Registration — New Secret or Certificate	New credential added to Entra app registration — persistence mechanism.	High	T1098.001	Audit Log
Entra ID OAuth Application Granted High-Privilege Consent	OAuth application granted Mail.Read, Files.ReadWrite.All, or equivalent broad scope.	High	T1528	Audit Log
Entra ID Guest User Added to Privileged Group	External/guest account added to security group with elevated access.	High	T1078	Audit Log
Entra ID Impossible Travel Sign-In — Successful	Successful authentication from two geographically impossible locations within hours.	High	T1078	Sign-In Log
Entra ID Sign-In from Tor Exit Node	Successful authentication via Tor anonymising network.	High	T1078	Sign-In Log
Entra ID Token Replay Detected by Identity Protection	Identity Protection detects token replay — stolen access token reused.	Critical	T1539	Sign-In Log
Entra ID Directory Synchronisation Account Used Interactively	MSOL or AAD Sync service account used for interactive authentication.	Critical	T1078.002	Sign-In Log
Entra ID Password Reset by Admin Without Ticket	Admin resets password outside normal IT ticketing process.	Medium	T1098	Audit Log
Entra ID Named Location Added to CA Policy Exclusion	New named location added to Conditional Access exclusion list.	High	T1548	Audit Log
Entra ID Service Principal Created with KeyCredential	New service principal created with certificate credential — non-interactive auth.	High	T1098.001	Audit Log
Entra ID Self-Service Password Reset Disabled	SSPR disabled for users — may prevent legitimate password recovery.	High	T1562.001	Audit Log
Entra ID Brute Force — Multiple Authentication Failures	More than 15 failed authentications in five minutes for a single account.	High	T1110	Sign-In Log
Entra ID External Federation Trust Added	New federated domain or trust relationship added to Entra tenant.	Critical	T1556.006	Audit Log
Entra ID Audit Log Deletion or Purge	Diagnostic settings deleted or audit log retention shortened.	Critical	T1562.008	Audit Log

Prerequisites

Entra ID diagnostic settings configured to export Sign-In and Audit logs to Log Analytics workspace or Event Hub
Microsoft Identity Protection P2 license for risk event data (P1 provides limited risk signals)
Privileged Identity Management enabled and audit logs exported for PIM-related detections
Entra ID Conditional Access configured — CA evaluation logs are required for bypass detections

Entra ID Detection Pack: frequently asked questions

What Entra ID log types does this detection pack use?

The Entra ID detection pack uses Sign-In Logs (interactive and non-interactive), Audit Logs (directory change events), Identity Protection risk events, Privileged Identity Management audit logs, and Conditional Access evaluation logs. All log types must be exported to a Log Analytics workspace or Event Hub for ingestion.

How does ManySignal use Microsoft Identity Protection risk signals?

ManySignal ingests Identity Protection risk events and incorporates them into its own risk scoring. When Identity Protection raises a high user or sign-in risk, ManySignal correlates this with other events (unusual resource access, mailbox delegation changes) to produce enriched, high-confidence alerts with investigation context.

Can ManySignal detect OAuth consent phishing attacks?

Yes. OAuth consent phishing (T1528) is a detection specifically targeting high-privilege OAuth application consent grants — especially for permissions like Mail.Read, Calendars.Read, Files.ReadWrite.All, or admin consent for all users in the tenant. ManySignal alerts on these grants immediately and surfaces the application's publisher verification status.

Does this pack cover Entra ID Privileged Identity Management?

Yes. PIM role activations outside business hours, activations from atypical locations, and role assignments that bypass PIM eligibility (direct permanent assignment) are all covered. PIM audit logs must be configured to flow to your Log Analytics workspace.

How does ManySignal handle Microsoft 365 Defender and Entra ID signal overlap?

ManySignal deduplicates Entra ID signals that are also surfaced in Microsoft 365 Defender incidents. When the same event appears in both sources, ManySignal merges the signals into a single alert with full context from both platforms, preventing double-alerting while preserving all available evidence.

Detect Entra ID identity threats before attackers establish M365 persistence

61 detection rules for Microsoft Entra ID with Identity Protection integration, PIM monitoring, and OAuth consent phishing coverage.

Book a demo Explore the platform