Users Authenticating To Other Azure AD Tenants

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•22

This rule detects successful user authentications from your Azure AD tenant to other Azure AD tenants. This activity can indicate an attacker attempting to maintain access or escalate privileges by leveraging existing user accounts to access resources in external tenants, or it could be a legitimate business-to-business (B2B) collaboration that needs to be approved.