Analytic rule catalog
[Entra ID] Domain Federation Trust Settings Modified
Back
| Id | 944d0ab5-b654-47f9-a398-2e77a0b7906e |
| Rulename | [Entra ID] Domain Federation Trust Settings Modified |
| Description | Detects changes to domain federation trust settings or domain authentication mode. These changes can be used to redirect sign-in trust and should be reviewed immediately. |
| Severity | High |
| Tactics | CredentialAccess Persistence |
| Techniques | T1555 T1098 |
| Required data connectors | AzureActiveDirectory |
| Kind | Scheduled |
| Query frequency | 1d |
| Query period | 1d |
| Trigger threshold | 0 |
| Trigger operator | gt |
| Source Uri | https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/eDCRule/Analytic%20Rules/%5BEntra%20ID%5D%20Domain%20Federation%20Trust%20Settings%20Modified.yaml |
| Version | 1.0.0 |
| Arm template | 944d0ab5-b654-47f9-a398-2e77a0b7906e.json |
(union isfuzzy=true
(
AuditLogs
| where OperationName =~ "Set federation settings on domain"
//| where Result =~ "success" // commenting out, as it may be interesting to capture failed attempts
| mv-expand TargetResources
| extend modifiedProperties = parse_json(TargetResources).modifiedProperties
| mv-expand modifiedProperties
| extend targetDisplayName = tostring(parse_json(modifiedProperties).displayName)
),
(
AuditLogs
| where OperationName =~ "Set domain authentication"
//| where Result =~ "success" // commenting out, as it may be interesting to capture failed attempts
| mv-expand TargetResources
| extend modifiedProperties = parse_json(TargetResources).modifiedProperties
| mv-expand modifiedProperties
| mv-apply Property = modifiedProperties on
(
where Property.displayName =~ "LiveType"
| extend
targetDisplayName = tostring(Property.displayName),
NewDomainValue = tostring(Property.newValue)
)
| where NewDomainValue has "Federated"
)
)
| mv-apply AdditionalDetail = AdditionalDetails on
(
where AdditionalDetail.key =~ "User-Agent"
| extend UserAgent = tostring(AdditionalDetail.value)
)
| extend InitiatingUserOrApp = iff(isnotempty(InitiatedBy.user.userPrincipalName), tostring(InitiatedBy.user.userPrincipalName), tostring(InitiatedBy.app.displayName))
| extend InitiatingAppName = tostring(InitiatedBy.app.displayName)
| extend InitiatingAppServicePrincipalId = tostring(InitiatedBy.app.servicePrincipalId)
| extend InitiatingUserPrincipalName = tostring(InitiatedBy.user.userPrincipalName)
| extend InitiatingAadUserId = tostring(InitiatedBy.user.id)
| extend InitiatingIpAddress = tostring(iff(isnotempty(InitiatedBy.user.ipAddress), InitiatedBy.user.ipAddress, InitiatedBy.app.ipAddress))
| extend InitiatingAppServicePrincipalName = tostring(InitiatedBy.app.displayName)
| extend
InitiatingAccountName = tostring(split(InitiatingUserPrincipalName, "@")[0]),
InitiatingAccountUPNSuffix = tostring(split(InitiatingUserPrincipalName, "@")[1])
| extend Source_Network_IPLocation = ""
| project
Alert_Time_TW = datetime_utc_to_local(TimeGenerated, 'Asia/Taipei'),
Alert_Time_UTC0 = TimeGenerated,
Alert_Category_en = "Entra ID",
Alert_SubCategory_en = "Anomaly Config Modification",
Alert_Name_en = "Domain Federation Trust Settings Modified",
Alert_Description_en=strcat(
"At Taiwan time: ",
format_datetime(datetime_utc_to_local(TimeGenerated, "Asia/Taipei"), "yyyy-MM-dd HH:mm:ss"),
" in Entra ID: ",
"",
", detected that Entra ID domain authentication was set to Federated",
" operation action: ",
iff(isnotempty(OperationName), OperationName, "<NoOperationName>"),
", changed property: ",
iff(isnotempty(targetDisplayName), targetDisplayName, "<NoProperty>"),
", operator/application: ",
iff(isnotempty(InitiatingUserOrApp), InitiatingUserOrApp, "<NoInitiator>"),
", source IP: ",
iff(isnotempty(InitiatingIpAddress), InitiatingIpAddress, "<NoIP>"),
", location: ",
iff(isnotempty(Source_Network_IPLocation), Source_Network_IPLocation, "<NoLocation>"),
", User-Agent:",
iff(isnotempty(UserAgent), UserAgent, "<NoUserAgent>"),
"This is a high-risk domain-level change that may allow the entire tenant identity to be taken over by external federation."
),
Alert_TriageStep_en=strcat(
"1. Confirm whether the change was authorized. Operation action: ",
iff(isnotempty(OperationName), OperationName, "<NoOperationName>"),
", operator: ",
iff(isnotempty(InitiatingUserOrApp), InitiatingUserOrApp, "<NoInitiator>"),
" has formal approval.",
"2. Check source risk. Source IP: ",
iff(isnotempty(InitiatingIpAddress), InitiatingIpAddress, "<NoIP>"),
", location: ",
iff(isnotempty(Source_Network_IPLocation), Source_Network_IPLocation, "<NoLocation>"),
" is a company named location or an abnormal country.",
"3. Check the operation tool User-Agent: ",
iff(isnotempty(UserAgent), UserAgent, "<NoUserAgent>"),
" to determine whether it is an expected management entry point (Portal/PowerShell/Graph) or a suspicious script.",
"4. Immediately inventory the impact scope: confirm which domains were set to Federated and whether all user sign-in flows are affected."
),
Alert_Containment_en=strcat(
"1. If determined to be an unauthorized change, immediately change the affected domain authentication method back to Managed and remove any unauthorized Federation settings. ",
"2. Immediately revoke the operator's sign-in tokens and administrative permissions, and reset the password and re-register MFA if necessary. ",
"3. Block the source IP immediately or restrict management-plane access to prevent continued change attempts. ",
"4. Initiate tenant emergency response: check whether any accounts have successfully signed in through the Federated domain and performed administrative operations."
),
Alert_Remediation_en=strcat(
"1. Strengthen domain-level governance: limit the role scope that can execute Set federation / Set domain authentication, and enforce two-person review. ",
"2. Strengthen Conditional Access: allow management-plane operations only from named locations, compliant devices, and MFA, and directly block abnormal countries or new User-Agents. ",
"3. Automated detection and response: establish SOAR for related events (notification, account suspension, source IP blocking). ",
"4. Regularly audit domain and federation settings: inventory all domain authentication modes and remove unnecessary or unused Federation and trust relationships."
),
//Event_Code = AliveTime,
Event_Action = OperationName,
//Event_Description = Role ,
Event_TimeRange_Start_TW = datetime_utc_to_local(TimeGenerated, 'Asia/Taipei'),
Event_TimeRange_End_TW = datetime_utc_to_local(TimeGenerated, 'Asia/Taipei'),
Source_Identity_FullName = InitiatingUserOrApp,
Source_Identity_Type = iff(isnotempty(InitiatingUserPrincipalName), "User", "Service"),
Source_Network_IPAddress = InitiatingIpAddress,
Source_Network_IPLocation = Source_Network_IPLocation,
Source_Identity_DomainType = iff(InitiatingUserPrincipalName contains "EXT", 'External', 'Internal'),
Source_Resource_Name = UserAgent,
Target_Identity_ID = targetDisplayName,
//Target_Identity_Type = "Service",
Target_Resource_ID = "",
Target_Resource_Name = "Microsoft Entra ID",
Target_Resource_Type = "Microsoft Entra ID"
kind: Scheduled
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/eDCRule/Analytic%20Rules/%5BEntra%20ID%5D%20Domain%20Federation%20Trust%20Settings%20Modified.yaml
version: 1.0.0
status: Available
requiredDataConnectors:
- dataTypes:
- AuditLogs
connectorId: AzureActiveDirectory
relevantTechniques:
- T1555
- T1098
query: |
(union isfuzzy=true
(
AuditLogs
| where OperationName =~ "Set federation settings on domain"
//| where Result =~ "success" // commenting out, as it may be interesting to capture failed attempts
| mv-expand TargetResources
| extend modifiedProperties = parse_json(TargetResources).modifiedProperties
| mv-expand modifiedProperties
| extend targetDisplayName = tostring(parse_json(modifiedProperties).displayName)
),
(
AuditLogs
| where OperationName =~ "Set domain authentication"
//| where Result =~ "success" // commenting out, as it may be interesting to capture failed attempts
| mv-expand TargetResources
| extend modifiedProperties = parse_json(TargetResources).modifiedProperties
| mv-expand modifiedProperties
| mv-apply Property = modifiedProperties on
(
where Property.displayName =~ "LiveType"
| extend
targetDisplayName = tostring(Property.displayName),
NewDomainValue = tostring(Property.newValue)
)
| where NewDomainValue has "Federated"
)
)
| mv-apply AdditionalDetail = AdditionalDetails on
(
where AdditionalDetail.key =~ "User-Agent"
| extend UserAgent = tostring(AdditionalDetail.value)
)
| extend InitiatingUserOrApp = iff(isnotempty(InitiatedBy.user.userPrincipalName), tostring(InitiatedBy.user.userPrincipalName), tostring(InitiatedBy.app.displayName))
| extend InitiatingAppName = tostring(InitiatedBy.app.displayName)
| extend InitiatingAppServicePrincipalId = tostring(InitiatedBy.app.servicePrincipalId)
| extend InitiatingUserPrincipalName = tostring(InitiatedBy.user.userPrincipalName)
| extend InitiatingAadUserId = tostring(InitiatedBy.user.id)
| extend InitiatingIpAddress = tostring(iff(isnotempty(InitiatedBy.user.ipAddress), InitiatedBy.user.ipAddress, InitiatedBy.app.ipAddress))
| extend InitiatingAppServicePrincipalName = tostring(InitiatedBy.app.displayName)
| extend
InitiatingAccountName = tostring(split(InitiatingUserPrincipalName, "@")[0]),
InitiatingAccountUPNSuffix = tostring(split(InitiatingUserPrincipalName, "@")[1])
| extend Source_Network_IPLocation = ""
| project
Alert_Time_TW = datetime_utc_to_local(TimeGenerated, 'Asia/Taipei'),
Alert_Time_UTC0 = TimeGenerated,
Alert_Category_en = "Entra ID",
Alert_SubCategory_en = "Anomaly Config Modification",
Alert_Name_en = "Domain Federation Trust Settings Modified",
Alert_Description_en=strcat(
"At Taiwan time: ",
format_datetime(datetime_utc_to_local(TimeGenerated, "Asia/Taipei"), "yyyy-MM-dd HH:mm:ss"),
" in Entra ID: ",
"",
", detected that Entra ID domain authentication was set to Federated",
" operation action: ",
iff(isnotempty(OperationName), OperationName, "<NoOperationName>"),
", changed property: ",
iff(isnotempty(targetDisplayName), targetDisplayName, "<NoProperty>"),
", operator/application: ",
iff(isnotempty(InitiatingUserOrApp), InitiatingUserOrApp, "<NoInitiator>"),
", source IP: ",
iff(isnotempty(InitiatingIpAddress), InitiatingIpAddress, "<NoIP>"),
", location: ",
iff(isnotempty(Source_Network_IPLocation), Source_Network_IPLocation, "<NoLocation>"),
", User-Agent:",
iff(isnotempty(UserAgent), UserAgent, "<NoUserAgent>"),
"This is a high-risk domain-level change that may allow the entire tenant identity to be taken over by external federation."
),
Alert_TriageStep_en=strcat(
"1. Confirm whether the change was authorized. Operation action: ",
iff(isnotempty(OperationName), OperationName, "<NoOperationName>"),
", operator: ",
iff(isnotempty(InitiatingUserOrApp), InitiatingUserOrApp, "<NoInitiator>"),
" has formal approval.",
"2. Check source risk. Source IP: ",
iff(isnotempty(InitiatingIpAddress), InitiatingIpAddress, "<NoIP>"),
", location: ",
iff(isnotempty(Source_Network_IPLocation), Source_Network_IPLocation, "<NoLocation>"),
" is a company named location or an abnormal country.",
"3. Check the operation tool User-Agent: ",
iff(isnotempty(UserAgent), UserAgent, "<NoUserAgent>"),
" to determine whether it is an expected management entry point (Portal/PowerShell/Graph) or a suspicious script.",
"4. Immediately inventory the impact scope: confirm which domains were set to Federated and whether all user sign-in flows are affected."
),
Alert_Containment_en=strcat(
"1. If determined to be an unauthorized change, immediately change the affected domain authentication method back to Managed and remove any unauthorized Federation settings. ",
"2. Immediately revoke the operator's sign-in tokens and administrative permissions, and reset the password and re-register MFA if necessary. ",
"3. Block the source IP immediately or restrict management-plane access to prevent continued change attempts. ",
"4. Initiate tenant emergency response: check whether any accounts have successfully signed in through the Federated domain and performed administrative operations."
),
Alert_Remediation_en=strcat(
"1. Strengthen domain-level governance: limit the role scope that can execute Set federation / Set domain authentication, and enforce two-person review. ",
"2. Strengthen Conditional Access: allow management-plane operations only from named locations, compliant devices, and MFA, and directly block abnormal countries or new User-Agents. ",
"3. Automated detection and response: establish SOAR for related events (notification, account suspension, source IP blocking). ",
"4. Regularly audit domain and federation settings: inventory all domain authentication modes and remove unnecessary or unused Federation and trust relationships."
),
//Event_Code = AliveTime,
Event_Action = OperationName,
//Event_Description = Role ,
Event_TimeRange_Start_TW = datetime_utc_to_local(TimeGenerated, 'Asia/Taipei'),
Event_TimeRange_End_TW = datetime_utc_to_local(TimeGenerated, 'Asia/Taipei'),
Source_Identity_FullName = InitiatingUserOrApp,
Source_Identity_Type = iff(isnotempty(InitiatingUserPrincipalName), "User", "Service"),
Source_Network_IPAddress = InitiatingIpAddress,
Source_Network_IPLocation = Source_Network_IPLocation,
Source_Identity_DomainType = iff(InitiatingUserPrincipalName contains "EXT", 'External', 'Internal'),
Source_Resource_Name = UserAgent,
Target_Identity_ID = targetDisplayName,
//Target_Identity_Type = "Service",
Target_Resource_ID = "",
Target_Resource_Name = "Microsoft Entra ID",
Target_Resource_Type = "Microsoft Entra ID"
tactics:
- CredentialAccess
- Persistence
queryFrequency: 1d
id: 944d0ab5-b654-47f9-a398-2e77a0b7906e
triggerThreshold: 0
triggerOperator: gt
name: '[Entra ID] Domain Federation Trust Settings Modified'
queryPeriod: 1d
severity: High
entityMappings:
- fieldMappings:
- columnName: Source_Identity_FullName
identifier: FullName
entityType: Account
- fieldMappings:
- columnName: Source_Network_IPAddress
identifier: Address
entityType: IP
description: |
Detects changes to domain federation trust settings or domain authentication mode. These changes can be used to redirect sign-in trust and should be reviewed immediately.
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"workspace": {
"type": "String"
}
},
"resources": [
{
"apiVersion": "2024-01-01-preview",
"id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/944d0ab5-b654-47f9-a398-2e77a0b7906e')]",
"kind": "Scheduled",
"name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/944d0ab5-b654-47f9-a398-2e77a0b7906e')]",
"properties": {
"alertRuleTemplateName": "944d0ab5-b654-47f9-a398-2e77a0b7906e",
"customDetails": null,
"description": "Detects changes to domain federation trust settings or domain authentication mode. These changes can be used to redirect sign-in trust and should be reviewed immediately.\n",
"displayName": "[Entra ID] Domain Federation Trust Settings Modified",
"enabled": true,
"entityMappings": [
{
"entityType": "Account",
"fieldMappings": [
{
"columnName": "Source_Identity_FullName",
"identifier": "FullName"
}
]
},
{
"entityType": "IP",
"fieldMappings": [
{
"columnName": "Source_Network_IPAddress",
"identifier": "Address"
}
]
}
],
"OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/eDCRule/Analytic%20Rules/%5BEntra%20ID%5D%20Domain%20Federation%20Trust%20Settings%20Modified.yaml",
"query": "(union isfuzzy=true\n (\n AuditLogs\n | where OperationName =~ \"Set federation settings on domain\"\n //| where Result =~ \"success\" // commenting out, as it may be interesting to capture failed attempts\n | mv-expand TargetResources\n | extend modifiedProperties = parse_json(TargetResources).modifiedProperties\n | mv-expand modifiedProperties\n | extend targetDisplayName = tostring(parse_json(modifiedProperties).displayName)\n ),\n (\n AuditLogs\n | where OperationName =~ \"Set domain authentication\"\n //| where Result =~ \"success\" // commenting out, as it may be interesting to capture failed attempts\n | mv-expand TargetResources\n | extend modifiedProperties = parse_json(TargetResources).modifiedProperties\n | mv-expand modifiedProperties\n | mv-apply Property = modifiedProperties on\n (\n where Property.displayName =~ \"LiveType\"\n | extend\n targetDisplayName = tostring(Property.displayName),\n NewDomainValue = tostring(Property.newValue)\n )\n | where NewDomainValue has \"Federated\"\n )\n)\n| mv-apply AdditionalDetail = AdditionalDetails on\n (\n where AdditionalDetail.key =~ \"User-Agent\"\n | extend UserAgent = tostring(AdditionalDetail.value)\n )\n| extend InitiatingUserOrApp = iff(isnotempty(InitiatedBy.user.userPrincipalName), tostring(InitiatedBy.user.userPrincipalName), tostring(InitiatedBy.app.displayName))\n| extend InitiatingAppName = tostring(InitiatedBy.app.displayName)\n| extend InitiatingAppServicePrincipalId = tostring(InitiatedBy.app.servicePrincipalId)\n| extend InitiatingUserPrincipalName = tostring(InitiatedBy.user.userPrincipalName)\n| extend InitiatingAadUserId = tostring(InitiatedBy.user.id)\n| extend InitiatingIpAddress = tostring(iff(isnotempty(InitiatedBy.user.ipAddress), InitiatedBy.user.ipAddress, InitiatedBy.app.ipAddress))\n| extend InitiatingAppServicePrincipalName = tostring(InitiatedBy.app.displayName)\n| extend\n InitiatingAccountName = tostring(split(InitiatingUserPrincipalName, \"@\")[0]),\n InitiatingAccountUPNSuffix = tostring(split(InitiatingUserPrincipalName, \"@\")[1])\n| extend Source_Network_IPLocation = \"\"\n| project\n Alert_Time_TW = datetime_utc_to_local(TimeGenerated, 'Asia/Taipei'),\n Alert_Time_UTC0 = TimeGenerated,\n Alert_Category_en = \"Entra ID\",\n Alert_SubCategory_en = \"Anomaly Config Modification\",\n Alert_Name_en = \"Domain Federation Trust Settings Modified\",\n Alert_Description_en=strcat(\n \"At Taiwan time: \",\n format_datetime(datetime_utc_to_local(TimeGenerated, \"Asia/Taipei\"), \"yyyy-MM-dd HH:mm:ss\"),\n \" in Entra ID: \",\n \"\",\n \", detected that Entra ID domain authentication was set to Federated\",\n \" operation action: \",\n iff(isnotempty(OperationName), OperationName, \"<NoOperationName>\"),\n \", changed property: \",\n iff(isnotempty(targetDisplayName), targetDisplayName, \"<NoProperty>\"),\n \", operator/application: \",\n iff(isnotempty(InitiatingUserOrApp), InitiatingUserOrApp, \"<NoInitiator>\"),\n \", source IP: \",\n iff(isnotempty(InitiatingIpAddress), InitiatingIpAddress, \"<NoIP>\"),\n \", location: \",\n iff(isnotempty(Source_Network_IPLocation), Source_Network_IPLocation, \"<NoLocation>\"),\n \", User-Agent:\",\n iff(isnotempty(UserAgent), UserAgent, \"<NoUserAgent>\"),\n \"This is a high-risk domain-level change that may allow the entire tenant identity to be taken over by external federation.\"\n ),\n Alert_TriageStep_en=strcat(\n \"1. Confirm whether the change was authorized. Operation action: \",\n iff(isnotempty(OperationName), OperationName, \"<NoOperationName>\"),\n \", operator: \",\n iff(isnotempty(InitiatingUserOrApp), InitiatingUserOrApp, \"<NoInitiator>\"),\n \" has formal approval.\",\n \"2. Check source risk. Source IP: \",\n iff(isnotempty(InitiatingIpAddress), InitiatingIpAddress, \"<NoIP>\"),\n \", location: \",\n iff(isnotempty(Source_Network_IPLocation), Source_Network_IPLocation, \"<NoLocation>\"),\n \" is a company named location or an abnormal country.\",\n \"3. Check the operation tool User-Agent: \",\n iff(isnotempty(UserAgent), UserAgent, \"<NoUserAgent>\"),\n \" to determine whether it is an expected management entry point (Portal/PowerShell/Graph) or a suspicious script.\",\n \"4. Immediately inventory the impact scope: confirm which domains were set to Federated and whether all user sign-in flows are affected.\"\n ),\n Alert_Containment_en=strcat(\n \"1. If determined to be an unauthorized change, immediately change the affected domain authentication method back to Managed and remove any unauthorized Federation settings. \",\n \"2. Immediately revoke the operator's sign-in tokens and administrative permissions, and reset the password and re-register MFA if necessary. \",\n \"3. Block the source IP immediately or restrict management-plane access to prevent continued change attempts. \",\n \"4. Initiate tenant emergency response: check whether any accounts have successfully signed in through the Federated domain and performed administrative operations.\"\n ),\n Alert_Remediation_en=strcat(\n \"1. Strengthen domain-level governance: limit the role scope that can execute Set federation / Set domain authentication, and enforce two-person review. \",\n \"2. Strengthen Conditional Access: allow management-plane operations only from named locations, compliant devices, and MFA, and directly block abnormal countries or new User-Agents. \",\n \"3. Automated detection and response: establish SOAR for related events (notification, account suspension, source IP blocking). \",\n \"4. Regularly audit domain and federation settings: inventory all domain authentication modes and remove unnecessary or unused Federation and trust relationships.\"\n ),\n //Event_Code = AliveTime,\n Event_Action = OperationName,\n //Event_Description = Role ,\n Event_TimeRange_Start_TW = datetime_utc_to_local(TimeGenerated, 'Asia/Taipei'),\n Event_TimeRange_End_TW = datetime_utc_to_local(TimeGenerated, 'Asia/Taipei'),\n Source_Identity_FullName = InitiatingUserOrApp,\n Source_Identity_Type = iff(isnotempty(InitiatingUserPrincipalName), \"User\", \"Service\"),\n Source_Network_IPAddress = InitiatingIpAddress,\n Source_Network_IPLocation = Source_Network_IPLocation,\n Source_Identity_DomainType = iff(InitiatingUserPrincipalName contains \"EXT\", 'External', 'Internal'),\n Source_Resource_Name = UserAgent,\n Target_Identity_ID = targetDisplayName,\n //Target_Identity_Type = \"Service\",\n Target_Resource_ID = \"\",\n Target_Resource_Name = \"Microsoft Entra ID\",\n Target_Resource_Type = \"Microsoft Entra ID\"\n",
"queryFrequency": "P1D",
"queryPeriod": "P1D",
"severity": "High",
"status": "Available",
"subTechniques": [],
"suppressionDuration": "PT1H",
"suppressionEnabled": false,
"tactics": [
"CredentialAccess",
"Persistence"
],
"techniques": [
"T1098",
"T1555"
],
"templateVersion": "1.0.0",
"triggerOperator": "GreaterThan",
"triggerThreshold": 0
},
"type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
}
]
}