Microsoft Entra ID MFA Method Modification Detected

nomit vyas@xoxo

•updated Jun 25, 2026•4•0•16

This rule detects network activity indicating a potential modification or interaction with Microsoft Entra ID (Azure AD) multifactor authentication (MFA) settings. Specifically, it looks for POST requests to the Microsoft Graph API targeting authentication methods (e.g., phoneAuthenticationMethod), which may be indicative of an attacker modifying MFA settings to bypass security controls or register rogue authentication devices.