New Federated Domain or Identity Provider Trust Added in Entra ID
This rule detects administrative changes to domain federation settings or domain authentication configurations within an Azure Active Directory (Microsoft Entra ID) environment. These modifications can be used to establish persistence or facilitate identity-based attacks, such as domain-wide impersonation, by altering how identities are authenticated.
Microsoft Sentinel (KQL)
