Entra Authentication Methods Policy Modified via Admin Activity

Ibrahim Saud@tektrix

•updated Sep 23, 2026•2•0•4

Detects unauthorized modifications to the Entra ID authentication methods policy or suspicious application activity often associated with the staging of rogue External Authentication Methods (EAM). Adversaries may exploit these configuration changes to intercept or bypass multi-factor authentication (MFA) during user login processes.