Entra Session Continuation: MAB Sign-in Followed by OfficeHome/OWA from Different IP within 15 Minutes

Duo Tech@duotech

•updated Jul 9, 2026•11•0•32

This rule detects scenarios where a user's session originates from the 'Microsoft Authentication Broker' and another application (like 'OfficeHome' or 'One Outlook Web') within a short window (15 minutes), but from different source IP addresses. This indicates potential session hijacking or the use of stolen session cookies by an external actor.