Suspicious Azure AD Device Registration

Ankit Mehta@Secvyn

•updated Jun 12, 2026•0•0•6

This rule detects suspicious activity related to Azure AD device registration. It identifies instances where a single user principal name (UPN) performs 5 or more device registrations or adds members to groups within a one-hour window, specifically targeting device resources. This could indicate an adversary attempting to register multiple devices to bypass conditional access policies or gain persistent access.