Azure Domain Federation Settings Modified

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•1•0•33

This rule identifies when a user or application modifies the federation settings on a domain within Azure Active Directory. Such modifications can impact how users authenticate and can be leveraged by attackers for persistence, privilege escalation, or defense evasion by altering trust relationships.