Identity Provider Authentication Settings Modified

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•6

This rule detects attempts to modify Identity Provider authentication settings within Microsoft Graph. Specifically, it looks for HTTP PATCH requests to the 'authentication' endpoint on 'graph.microsoft.com'. This activity could indicate an attacker attempting to alter authentication mechanisms, potentially for persistence or to facilitate further access.