O365 Entra ID Application Creation

Google SecOps@GoogleSecOps

•updated Jan 30, 2025•1•0•33

This rule detects the creation of new applications within Microsoft Entra ID (formerly Azure AD). While application creation is a legitimate administrative activity, it does not occur frequently. Monitoring this event can help identify unauthorized or suspicious application registrations that could be used for persistence, privilege escalation, or other malicious activities within the cloud environment.