Azure AD User Risk and MFA Registration Policy Updated

SigmaHQ Detections@sigmaHQ

•updated Jul 1, 2025•0•43

This rule detects when the user risk and multi-factor authentication (MFA) registration policy is updated within Azure Active Directory (AAD). Attackers may modify these policies to bypass MFA, weaken security thresholds, facilitate further attacks, or maintain persistence by altering how users authenticate or register for MFA.