Device Registration Service sign-in for rogue device/PRT acquisition

Ibrahim Saud@tektrix

•updated Sep 17, 2026•2•0•5

Detects successful authentication events associated with the Azure AD Device Registration Service (resource ID 01cb2876-7ebd-4aa4-9cc9-d28bd4d359a9). This rule identifies successful registrations or sign-ins to the service, which may be leveraged by adversaries to register unauthorized devices for persistent access or to bypass conditional access policies.