Hybrid Identity Federation Settings Modified

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•4

This rule detects attempts to modify hybrid identity federation settings by monitoring HTTP POST requests to graph.microsoft.com with a URI containing 'federationConfiguration'. This activity could indicate an attacker attempting to establish persistence or gain unauthorized access by manipulating identity federation.