New Device Join Immediately After Credential/MFA Recovery Event

Ibrahim Saud@tektrix

•updated Sep 24, 2026•0•0•1

Detects an Azure AD/Entra ID device registration or join event occurring within 60 minutes of an account-recovery action (password reset, MFA reset, or account unlock) for the same user identity. This sequence is indicative of an attacker registering a managed device to maintain persistent, long-term access following a successful account takeover or vishing-based helpdesk credential reset.