Successful Risky Sign-in from Unregistered Device Without MFA

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•36

This rule detects successful sign-in attempts to Azure AD from devices that are not registered in Active Directory (non-compliant devices) and where Multi-Factor Authentication (MFA) was not required. The sign-in is also flagged as 'atRisk' by Azure AD. This scenario can indicate an adversary attempting to gain initial access or maintain persistence using compromised credentials from an unregistered device, bypassing stronger authentication controls.