Sign-in to My Sign-Ins portal shortly after risky authentication event

Ibrahim Saud@tektrix

•updated Sep 16, 2026•5•0•5

This rule detects successful authentication to Azure/M365 identity and security management portals (My Sign-Ins, My Apps, My Profile) shortly after a risky or suspicious sign-in event for the same user. This pattern often indicates an account takeover scenario where an adversary, having potentially compromised credentials, immediately accesses account settings to perform further malicious actions, such as registering MFA devices or updating security proofs.