Alerts related to data source "AzureAD Audit Log".
Authentication method added to an Azure account
Azure account creation by a non-standard account
Azure account deletion by a non-standard account
Azure AD account unlock/password reset attempt
Azure AD PIM alert disabled
Azure AD PIM elevation request
Azure AD PIM role settings change
Azure application consent
Azure application credentials added
Azure application URI modification
Azure domain federation settings modification attempt
Azure Privilege Escalation Using an Application
Azure service principal assigned app role
Azure Temporary Access Pass (TAP) registered to an account
BitLocker key retrieval
Conditional Access policy removed
Device Registration Policy modification
First Azure AD PowerShell operation for a user
First-time directory sync of an on-premises domain user to an existing cloud account
Identity assigned an Azure AD Administrator Role
MFA was disabled for an Azure identity
Multiple Azure AD admin role removals
Owner added to Azure application
Possible Insider Threat Activity
Possible phishing attack via Microsoft Teams
Potential extraction of NAA Account Credentials in Microsoft Configuration Manager
Short-lived Azure AD user account
Successful unusual guest user invitation
Suspicious MFA request reported by user in Entra ID
Unusual Conditional Access operation for an identity
Unverified domain added to Azure AD
Was this helpful?
