Entra ID Detection Update
A detection release for Microsoft Entra ID and Microsoft 365, rolled out October 18–20, 2026. It adds 19 alerting behavior rules and 12 context rules covering three campaigns reported by Microsoft Threat Intelligence — Storm-2755's adversary-in-the-middle (AiTM) session theft, Storm-2372's device-code phishing, and Storm-3119's takeover of whole tenants through a registered app — plus detections for persistence, privilege and sign-in abuse. Five older rules are retired or removed.
No action is needed: the rules sync to every instance automatically.
Rollout and requirements
- Rollout. All rules are published to the default rule set and reach each instance through resource sync within about two hours. No configuration is needed.
- Data sources. The sign-in rules need Entra ID sign-in logs, and the app, role and federation rules need Entra ID audit logs; Entra ID Audit via Event Hubs collects both. The
Office365_*rules need the Microsoft 365 unified audit log (Office365 Audit API or Office 365 Audit). An instance with only the Microsoft 365 audit log still gets the AiTM capture, mail and file activity, broker-phish and inbox-rule detections. - Expected volume. The campaign detections are designed to be rare. Expect the medium-severity rules (
EntraID_Valid_Password_Blocked,EntraID_DeviceCode_UserApp,EntraID_High_Risk_App_Permission,EntraID_Privileged_Role_Assigned) to fire on planned admin work and on users blocked by your own Conditional Access policies.
How the rules work
Each new rule is either a detection, which raises a behavior alert at the severity shown, or context, which adds an event to the user's timeline without raising an alert. Severity levels and the high-confidence tag are described in Risk Scoring.
Several of the strongest detections are correlations. They follow one session, one user or one app across sign-in and audit records for hours or days, and alert only when the whole pattern appears. This keeps them quiet on normal activity that looks like a single step of an attack.
New detections
Storm-2755: adversary-in-the-middle session theft
Storm-2755 sends victims to a fake Microsoft 365 sign-in page through search ads and SEO poisoning. The page relays the real sign-in, so the victim completes MFA and the attacker keeps the session token. The actor then replays the token, searches for payroll and HR content, hides replies with inbox rules, and in one reported case changed the victim's bank details in the payroll system.
MFA does not stop this: the stolen token is an already-authenticated session, and the attacker never sees an MFA prompt. The useful signals are the proxied sign-in itself, and the same session ID appearing later from networks the user has never used.
| ID | Rule | Severity | Fires when |
|---|---|---|---|
| 102111 | EntraID_AiTM_Capture | High confidence | An interactive sign-in ends in a specific error code after MFA was met. A phishing proxy relaying the sign-in drops a field Entra ID asks for, and the session it got still works. Users' own sign-ins almost never end this way. |
| 102105 | Office365_AiTM_Capture | High confidence | The same capture, from the Microsoft 365 unified audit log. |
| 102113 | EntraID_AiTM_Session_Replay | High confidence | Any later sign-in or token refresh on the captured session ID, from a network the user did not have at the time of capture. The user's own office, home and company proxy are not raised. High confidence for 14 days after the capture, medium from 14 to 90 days. |
| 102114 | EntraID_AiTM_Session_Activity | High confidence | Exchange, SharePoint or OneDrive activity under the captured session from a new network — the reconnaissance stage, where Storm-2755 searched for payroll and banking content. |
| 102106 | Office365_InboxRule_Odd_Name | High | An inbox rule is created or renamed with a name made only of punctuation or a single character, which is how BEC actors keep the rule from standing out. Rules with ordinary names are not matched. |
New and changed authentication methods — how the attacker adds their own MFA method — go on the user's timeline as context, so an investigation of these alerts shows them.
Storm-2372: device-code phishing
Storm-2372 builds rapport with a target over WhatsApp, Signal or Teams, then sends a fake Teams meeting invitation whose "meeting ID" is a device code. When the user enters it at microsoft.com/devicelogin, the attacker's device receives the user's tokens. Since February 2025 the actor has used the Microsoft Authentication Broker client ID, which lets it register a device in Entra ID and keep access.
The user signs in to a real Microsoft page and completes MFA, and Teams Rooms devices, desk phones and admin tools use the same flow legitimately. The rules separate the two by what happens next: whether the approved session turns up from another network or country.
| ID | Rule | Severity | Fires when |
|---|---|---|---|
| 102129 | EntraID_DeviceCode_UserApp | Medium | A user's first device-code sign-in to an application that is not an admin tool (the broker, Office, Teams, Outlook). Azure CLI, Azure PowerShell and the Graph command-line tools are not matched. |
| 102115 | EntraID_DeviceCode_Phish | High confidence | A session approved with a device code signs in or refreshes its token from a new network, in a new country, within an hour. |
| 102109 | Office365_Broker_Phish | High confidence | A broker-approved session signs in or refreshes its token from a network it had not used: high confidence within an hour when the country is also new, medium otherwise and for up to 14 days. Also raised when a device registered to the user within 10 minutes of the approval then signs in from a new network. |
A Teams room or phone set up with a code signs in from its own network in the same country, so it does not raise the phish alerts.
Storm-3119: tenant takeover through a registered app
Storm-3119 (YAM Store) is an access broker that resells hijacked Microsoft 365 tenants to phishing operators. With a compromised Global Administrator it provisions an app (the PnP Management Shell service principal), grants it broad Microsoft Graph and SharePoint permissions such as AppCatalog.ReadWrite.All, and adds a client secret. From then on the app works with no user signed in: it resets passwords without forcing a change, assigns licenses and grants privileges. Microsoft and Health-ISAC seized the group's domains on October 14, 2026.
The app's client secret is a separate credential, so resetting the admin's password and revoking their sessions leaves the app working. Each step on its own also looks like ordinary admin work, which is why this detection follows one app through all of them.
| ID | Rule | Severity | Fires when |
|---|---|---|---|
| 102157 | EntraID_App_Takeover | Critical, High or Medium | Within 72 hours: critical when an app holding a high-risk permission acts on users, roles or licenses; high when a new or newly keyed app does; medium when an app gets a high-risk permission and a new secret. Each level alerts once per app, keyed on the admin who set the app up. Released October 19. |
| 102118 | EntraID_High_Risk_App_Permission | Medium | An app is granted a high-risk Graph or Exchange permission. On October 19 the list gained User.ReadWrite.All, User-PasswordProfile.ReadWrite.All and AppCatalog.ReadWrite.All. |
If you set up PnP or other automation apps yourself, expect a medium EntraID_App_Takeover alert that you can close as expected.
Persistence, privilege and sign-in
These cover techniques that the campaigns above, and others such as Midnight Blizzard, use once they have a foothold.
| ID | Rule | Severity | Fires when |
|---|---|---|---|
| 102120 | EntraID_Federation_Changed | High | A domain is set to federated, or its federation settings change. A rogue trust lets an attacker sign in as any user of the domain. |
| 102121 | EntraID_Elevated_Access | High | A Global Administrator elevates to User Access Administrator over all Azure subscriptions. |
| 102117 | EntraID_FIC_Changed | Medium | A federated identity credential is added to or removed from an app. Tokens from that issuer then sign in as the app without a secret, and secret rotation does not remove them. |
| 102119 | EntraID_Privileged_Role_Assigned | Medium | A user, group or app is given a privileged Entra ID role or the Azure Owner, User Access Administrator or RBAC Administrator role — directly, through PIM, or as eligible. |
| 102128 | EntraID_High_Risk_SignIn | High | Entra ID Protection rates a sign-in high risk at sign-in time. |
| 102125 | EntraID_MFA_Fatigue | High | More than 2 MFA denials or timeouts for one user in an hour (push bombing). |
| 102126 | EntraID_MFA_Fraud_Reported | High | A user reports an MFA prompt as fraud. |
| 102124 | EntraID_Brute_Force_User | Medium | More than 15 failed interactive sign-ins for one user in an hour, from any number of IPs. Catches botnets that send one attempt per IP. |
| 102127 | EntraID_Valid_Password_Blocked | Medium | Conditional Access blocks a sign-in right after the correct password was entered: whoever made the attempt knows the password. Users on unmanaged devices or in blocked countries also trigger it. |
Context rules
These add events to the timeline, or feed the correlations above, without raising alerts. Some are used only inside a correlation and do not appear as events on their own.
| ID | Rule | Records |
|---|---|---|
| 102131 | EntraID_App_Created | An app registration or service principal created (managed identities and Microsoft's own apps excluded). Feeds EntraID_App_Takeover. |
| 102130 | EntraID_App_Credential_Change | A secret or certificate added to or removed from an app. Feeds EntraID_App_Takeover. |
| 102139 | EntraID_Admin_Password_Reset | A password reset by an admin or an app. Feeds EntraID_App_Takeover. |
| 102134 | EntraID_Role_Member_Added | A non-privileged role assignment. Feeds EntraID_App_Takeover. |
| 102156 | EntraID_App_License_Change | A license change made by an app. Feeds EntraID_App_Takeover. |
| 102116 | EntraID_DeviceCode_Consent | A user entered a device code. Recorded for every application. Feeds EntraID_DeviceCode_Phish and Office365_Broker_Phish. |
| 102110 | Office365_Broker_Consent | A broker sign-in approved on Microsoft's "Are you trying to sign in?" page. Feeds Office365_Broker_Phish. |
| 102108 | Office365_Device_Registration | A device registered to a user. Feeds Office365_Broker_Phish. |
| 102112 | EntraID_AiTM_Session | Sign-in session lines used to learn each user's networks. Used only inside the AiTM correlation. |
| 102107 | Office365_AiTM_Session | Mail and file activity with its session. Used only inside the AiTM correlation. |
| 102102 | EntraID_User_Add_Authentication_Method | An authentication method registered. Changed from a high alert to context: a passkey rollout raised one alert per user. |
| 102103 | EntraID_User_Update_Authentication_Method | An authentication method changed. Changed from a high alert to context, for the same reason. |
Retired and removed
A rule taken out of the release is deleted from each instance at its next sync.
| ID | Rule | Status | Why, and what covers it now |
|---|---|---|---|
| 101907 | AzureAD_SFA_Login_Success | Retired | Older log format. Replaced by EntraID_SFA_Login_Success (102104). |
| 101984 | AzureAD_User_Add_Authentication_Method | Retired | Duplicated the new rule. Replaced by EntraID_User_Add_Authentication_Method (102102). |
| 102095 | AzureAD_User_Update_Authentication_Method | Retired | Duplicated the new rule. Replaced by EntraID_User_Update_Authentication_Method (102103). |
| 102122 | EntraID_Attack_Tool_UserAgent | Removed | A list of tool user agents was noisy and hard to validate: legitimate clients send library and headless-browser user agents too. The user agent stays on every sign-in alert. |
| 102123 | EntraID_Password_Spray_IP | Removed | Failures per source IP move to a daily password-spray report. EntraID_Brute_Force_User stays. |
Triage guidance
| Alert | Check first | Respond |
|---|---|---|
EntraID_AiTM_Capture, Office365_AiTM_Capture | The URL the user clicked (often a search ad or an email link), the sign-in's IP and ASN, and whether the detected OS matches the user agent — a mismatch is common for a proxy. | Revoke the user's sessions now, before a replay. Reset the password, and review MFA methods and inbox rules. |
EntraID_AiTM_Session_Replay, EntraID_AiTM_Session_Activity | The new networks and countries, the apps used, and which mail or files were read. | Revoke sessions and refresh tokens, remove attacker MFA methods and inbox rules, and check payroll and banking changes. |
Office365_Broker_Phish, EntraID_DeviceCode_Phish | Ask the user whether they entered a code, and from what message. Check for a device registered right after the approval. | Revoke sessions, delete the attacker's registered device, and block the device-code flow with Conditional Access where it is not needed. |
EntraID_App_Takeover | The app's name and owner, who granted its permissions and added its secret, and which users it changed. | Contain the app first: disable it and remove its secrets and role assignments. Then secure the admin account. A password reset alone leaves the app's secret working. |
EntraID_Federation_Changed, EntraID_FIC_Changed | Whether the change was planned. For a federated credential, the issuer and subject, and whether the issuer is outside the tenant. | Revert an unplanned trust or credential, then review sign-ins through it. |
Rule IDs are the same on every instance. To find these alerts, search behavior events by rule name; each rule is also listed by name on the Behavior Rules page.
References
- Microsoft Threat Intelligence, Investigating Storm-2755: "Payroll pirate" attacks targeting Canadian employees, April 9, 2026.
- Microsoft Threat Intelligence, Storm-2372 conducts device code phishing campaign, February 13, 2025, updated 2026.
- Microsoft Threat Intelligence, The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime (Storm-3119, YAM Store), October 14, 2026.