New Federated Domain Added

SigmaHQ Detections@sigmaHQ

•updated Aug 14, 2025•1•0•33

Detects the addition of a new Federated Domain within Microsoft 365 audit logs. This activity can be a legitimate administrative action but also indicates potential federated credential abuse or the establishment of a backdoor via federated identities.