Identity Rules

6 detection rules in this category.

Rule	Severity	MITRE	Source
Admin role assigned	High	T1098.001	AuditLog
Conditional Access policy deleted	High	T1562.001	AuditLog
Federation settings changed	Critical	T1484.002	AuditLog
Global Administrator role assigned	Critical	T1098.001	AuditLog
MFA disabled for user	Critical	T1556.006	AuditLog
User password reset by admin	Medium	T1098	AuditLog

---

Admin role assigned

Property	Value
Severity	🟠 High
Source	AuditLog
MITRE	T1098.001 (Persistence)

User added to an administrative role

Conditions

• Match: all
• Operation Equals Add member to role
• ModifiedProperties Contains Admin

---

Conditional Access policy deleted

Property	Value
Severity	🟠 High
Source	AuditLog
MITRE	T1562.001 (Defense Evasion)

Conditional Access policy deleted

Conditions

• Match: all
• Operation Equals Delete conditional access policy

---

Federation settings changed

Property	Value
Severity	🔴 Critical
Source	AuditLog
MITRE	T1484.002 (Defense Evasion)

Domain federation settings modified - potential backdoor

Conditions

• Match: all
• Operation Equals Set domain authentication

---

Global Administrator role assigned

Property	Value
Severity	🔴 Critical
Source	AuditLog
MITRE	T1098.001 (Persistence)

User added to Global Administrator role

Conditions

• Match: all
• Operation Equals Add member to role
• ModifiedProperties Contains Global Administrator

---

MFA disabled for user

Property	Value
Severity	🔴 Critical
Source	AuditLog
MITRE	T1556.006 (Defense Evasion)

Multi-factor authentication disabled for a user

Conditions

• Match: all
• Operation Equals Disable Strong Authentication

---

User password reset by admin

Property	Value
Severity	🟡 Medium
Source	AuditLog
MITRE	T1098 (Persistence)

Administrator reset a user's password (actor differs from target)

Conditions

• Match: all
• Operation Equals Reset user password
• InitiatedBy.User.UserPrincipalName NotEquals {⁠{TargetResources.0.UserPrincipalName}⁠}