Device Registration or Join Without MFA in Azure AD

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•1•0•34

Monitors for successful device registration or join events in Azure AD where Multi-Factor Authentication (MFA) was not performed. This could indicate an adversary bypassing MFA to gain persistent access or escalate privileges by registering a new device.