Suspicious MFA/security info registration or password reset events

Ankit Mehta@Secvyn

•updated Sep 10, 2026•1•0•4

This rule monitors for security-related account activities in Azure AD, specifically tracking self-service password resets, admin-led password resets, and changes to user security information. It aggregates these events by user to identify potential account manipulation, unauthorized password changes, or MFA registration abuse.