MFA Disabled in Azure Active Directory

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•2•0•91

This rule detects when multi-factor authentication (MFA) has been explicitly disabled for a user in Azure Active Directory. This activity could indicate an adversary attempting to bypass authentication mechanisms to gain unauthorized access or maintain persistence.