Azure AD User Enabled And Password Reset

The analytic detects an Azure AD user enabling a previously disabled account and resetting its password within 2 minutes. This activity is significant because it may indicate an adversary with administrative access attempting to establish a backdoor identity within the Azure AD tenant. If confirmed malicious, this could allow the attacker to maintain persistent access, escalate privileges, and potentially exfiltrate sensitive information from the environment.