Entra Authentication Methods Policy Modified to Add External Auth Method
Detects modifications to the Entra ID Authentication Methods policy that involve adding or updating an external authentication method. This activity could indicate that an adversary is attempting to configure a malicious or rogue external MFA provider to facilitate authentication bypass or persistent access to the environment.
Sigma
