{ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "workspace": { "type": "String" } }, "resources": [ { "apiVersion": "2024-01-01-preview", "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/944d0ab5-b654-47f9-a398-2e77a0b7906e')]", "kind": "Scheduled", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/944d0ab5-b654-47f9-a398-2e77a0b7906e')]", "properties": { "alertRuleTemplateName": "944d0ab5-b654-47f9-a398-2e77a0b7906e", "customDetails": null, "description": "Detects changes to domain federation trust settings or domain authentication mode. These changes can be used to redirect sign-in trust and should be reviewed immediately.\n", "displayName": "[Entra ID] Domain Federation Trust Settings Modified", "enabled": true, "entityMappings": [ { "entityType": "Account", "fieldMappings": [ { "columnName": "Source_Identity_FullName", "identifier": "FullName" } ] }, { "entityType": "IP", "fieldMappings": [ { "columnName": "Source_Network_IPAddress", "identifier": "Address" } ] } ], "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/eDCRule/Analytic%20Rules/%5BEntra%20ID%5D%20Domain%20Federation%20Trust%20Settings%20Modified.yaml", "query": "(union isfuzzy=true\n (\n AuditLogs\n | where OperationName =~ \"Set federation settings on domain\"\n //| where Result =~ \"success\" // commenting out, as it may be interesting to capture failed attempts\n | mv-expand TargetResources\n | extend modifiedProperties = parse_json(TargetResources).modifiedProperties\n | mv-expand modifiedProperties\n | extend targetDisplayName = tostring(parse_json(modifiedProperties).displayName)\n ),\n (\n AuditLogs\n | where OperationName =~ \"Set domain authentication\"\n //| where Result =~ \"success\" // commenting out, as it may be interesting to capture failed attempts\n | mv-expand TargetResources\n | extend modifiedProperties = parse_json(TargetResources).modifiedProperties\n | mv-expand modifiedProperties\n | mv-apply Property = modifiedProperties on\n (\n where Property.displayName =~ \"LiveType\"\n | extend\n targetDisplayName = tostring(Property.displayName),\n NewDomainValue = tostring(Property.newValue)\n )\n | where NewDomainValue has \"Federated\"\n )\n)\n| mv-apply AdditionalDetail = AdditionalDetails on\n (\n where AdditionalDetail.key =~ \"User-Agent\"\n | extend UserAgent = tostring(AdditionalDetail.value)\n )\n| extend InitiatingUserOrApp = iff(isnotempty(InitiatedBy.user.userPrincipalName), tostring(InitiatedBy.user.userPrincipalName), tostring(InitiatedBy.app.displayName))\n| extend InitiatingAppName = tostring(InitiatedBy.app.displayName)\n| extend InitiatingAppServicePrincipalId = tostring(InitiatedBy.app.servicePrincipalId)\n| extend InitiatingUserPrincipalName = tostring(InitiatedBy.user.userPrincipalName)\n| extend InitiatingAadUserId = tostring(InitiatedBy.user.id)\n| extend InitiatingIpAddress = tostring(iff(isnotempty(InitiatedBy.user.ipAddress), InitiatedBy.user.ipAddress, InitiatedBy.app.ipAddress))\n| extend InitiatingAppServicePrincipalName = tostring(InitiatedBy.app.displayName)\n| extend\n InitiatingAccountName = tostring(split(InitiatingUserPrincipalName, \"@\")[0]),\n InitiatingAccountUPNSuffix = tostring(split(InitiatingUserPrincipalName, \"@\")[1])\n| extend Source_Network_IPLocation = \"\"\n| project\n Alert_Time_TW = datetime_utc_to_local(TimeGenerated, 'Asia/Taipei'),\n Alert_Time_UTC0 = TimeGenerated,\n Alert_Category_en = \"Entra ID\",\n Alert_SubCategory_en = \"Anomaly Config Modification\",\n Alert_Name_en = \"Domain Federation Trust Settings Modified\",\n Alert_Description_en=strcat(\n \"At Taiwan time: \",\n format_datetime(datetime_utc_to_local(TimeGenerated, \"Asia/Taipei\"), \"yyyy-MM-dd HH:mm:ss\"),\n \" in Entra ID: \",\n \"\",\n \", detected that Entra ID domain authentication was set to Federated\",\n \" operation action: \",\n iff(isnotempty(OperationName), OperationName, \"\"),\n \", changed property: \",\n iff(isnotempty(targetDisplayName), targetDisplayName, \"\"),\n \", operator/application: \",\n iff(isnotempty(InitiatingUserOrApp), InitiatingUserOrApp, \"\"),\n \", source IP: \",\n iff(isnotempty(InitiatingIpAddress), InitiatingIpAddress, \"\"),\n \", location: \",\n iff(isnotempty(Source_Network_IPLocation), Source_Network_IPLocation, \"\"),\n \", User-Agent:\",\n iff(isnotempty(UserAgent), UserAgent, \"\"),\n \"This is a high-risk domain-level change that may allow the entire tenant identity to be taken over by external federation.\"\n ),\n Alert_TriageStep_en=strcat(\n \"1. Confirm whether the change was authorized. Operation action: \",\n iff(isnotempty(OperationName), OperationName, \"\"),\n \", operator: \",\n iff(isnotempty(InitiatingUserOrApp), InitiatingUserOrApp, \"\"),\n \" has formal approval.\",\n \"2. Check source risk. Source IP: \",\n iff(isnotempty(InitiatingIpAddress), InitiatingIpAddress, \"\"),\n \", location: \",\n iff(isnotempty(Source_Network_IPLocation), Source_Network_IPLocation, \"\"),\n \" is a company named location or an abnormal country.\",\n \"3. Check the operation tool User-Agent: \",\n iff(isnotempty(UserAgent), UserAgent, \"\"),\n \" to determine whether it is an expected management entry point (Portal/PowerShell/Graph) or a suspicious script.\",\n \"4. Immediately inventory the impact scope: confirm which domains were set to Federated and whether all user sign-in flows are affected.\"\n ),\n Alert_Containment_en=strcat(\n \"1. If determined to be an unauthorized change, immediately change the affected domain authentication method back to Managed and remove any unauthorized Federation settings. \",\n \"2. Immediately revoke the operator's sign-in tokens and administrative permissions, and reset the password and re-register MFA if necessary. \",\n \"3. Block the source IP immediately or restrict management-plane access to prevent continued change attempts. \",\n \"4. Initiate tenant emergency response: check whether any accounts have successfully signed in through the Federated domain and performed administrative operations.\"\n ),\n Alert_Remediation_en=strcat(\n \"1. Strengthen domain-level governance: limit the role scope that can execute Set federation / Set domain authentication, and enforce two-person review. \",\n \"2. Strengthen Conditional Access: allow management-plane operations only from named locations, compliant devices, and MFA, and directly block abnormal countries or new User-Agents. \",\n \"3. Automated detection and response: establish SOAR for related events (notification, account suspension, source IP blocking). \",\n \"4. Regularly audit domain and federation settings: inventory all domain authentication modes and remove unnecessary or unused Federation and trust relationships.\"\n ),\n //Event_Code = AliveTime,\n Event_Action = OperationName,\n //Event_Description = Role ,\n Event_TimeRange_Start_TW = datetime_utc_to_local(TimeGenerated, 'Asia/Taipei'),\n Event_TimeRange_End_TW = datetime_utc_to_local(TimeGenerated, 'Asia/Taipei'),\n Source_Identity_FullName = InitiatingUserOrApp,\n Source_Identity_Type = iff(isnotempty(InitiatingUserPrincipalName), \"User\", \"Service\"),\n Source_Network_IPAddress = InitiatingIpAddress,\n Source_Network_IPLocation = Source_Network_IPLocation,\n Source_Identity_DomainType = iff(InitiatingUserPrincipalName contains \"EXT\", 'External', 'Internal'),\n Source_Resource_Name = UserAgent,\n Target_Identity_ID = targetDisplayName,\n //Target_Identity_Type = \"Service\",\n Target_Resource_ID = \"\",\n Target_Resource_Name = \"Microsoft Entra ID\",\n Target_Resource_Type = \"Microsoft Entra ID\"\n", "queryFrequency": "P1D", "queryPeriod": "P1D", "severity": "High", "status": "Available", "subTechniques": [], "suppressionDuration": "PT1H", "suppressionEnabled": false, "tactics": [ "CredentialAccess", "Persistence" ], "techniques": [ "T1098", "T1555" ], "templateVersion": "1.0.0", "triggerOperator": "GreaterThan", "triggerThreshold": 0 }, "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules" } ] }