Entra ID Detection Update
A detection release for Microsoft Entra ID and Microsoft 365, rolled out October 18–20, 2026. It adds 19 alerting behavior rules and 12 context rules covering three campaigns reported by Microsoft Threat Intelligence — Storm-2755's adversary-in-the-middle (AiTM) session theft, Storm-2372's device-code phishing, and Storm-3119's takeover of whole tenants through a registered app — plus detections for persistence, privilege and sign-in abuse. Five older rules are retired or removed.
No action is needed: the rules sync to every instance automatically.