Azure AD Single Factor Authentication Detected

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•28

Detects when users successfully authenticate to Azure AD using only single-factor authentication, indicating that MFA was not required or was bypassed. This could be due to misconfiguration, an attacker bypassing MFA, or legitimate exceptions.