New or Modified Pass-Through Authentication (PTA) Agent Registration

Ankit Mehta@Secvyn

•updated Aug 7, 2026•4•0•2

This rule detects modifications or registrations of Pass-Through Authentication (PTA) agents and changes to federation settings within an identity tenant. Such actions can indicate an adversary attempting to establish persistence, bypass authentication mechanisms, or intercept credentials by manipulating the authentication infrastructure.