Azure AD Application AppID URI Configuration Changes

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•22

Detects when a configuration change is made to an application's AppID URI in Azure Active Directory (now Microsoft Entra ID). This change can be indicative of an adversary attempting to modify an application's identity to facilitate malicious activities such as phishing, unauthorized access, or maintaining persistence.