Python UA -> Entra ID Device Registration Service

F S@Fsdr

•updated Jul 10, 2026•16•1•31

This rule detects authentication attempts to the 'Device Registration Service' in Entra ID where the User-Agent string contains 'python'. This is often indicative of automated scripts, such as those using libraries like msal, being used to interact with device management APIs, which may be associated with legitimate automation or adversary activity.