Unauthorized Azure AD Account Creation or Deletion

A’Keem Gurley@MFA_meex

•updated Feb 22, 2026•3•0•77

This rule identifies the creation or deletion of user accounts in Azure AD (Entra ID) by principals not on an approved list. It relies on a customized list of approved administrators/service principals to reduce false positives.