Anomalous Sign-In or Privileged Role Grant for AAD Connect Sync Account

Ankit Mehta@Secvyn

•updated Aug 11, 2026•5•0•3

This rule monitors for potentially malicious activities involving Azure AD Connect synchronization accounts. It flags anomalous sign-in events (e.g., interactive sign-ins or sign-ins originating from unauthorized IP addresses) and tracks when these sync accounts are granted privileged roles within the environment.