← Back to SOC feed Coverage →

Administrators Authenticating to Another Microsoft Entra ID Tenant

kql MEDIUM Azure-Sentinel
T1078.004
IdentityInfoSigninLogs
backdoorhuntingmicrosoftofficial
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Azure-Sentinel →
Retrieved: 2026-06-04T11:00:00Z · Confidence: medium

Hunt Hypothesis

Privileged users authenticating from one Microsoft Entra ID tenant to another may indicate lateral movement or unauthorized access between environments. SOC teams should proactively hunt for this behavior to identify potential credential compromise or insider threats in their Azure Sentinel environment.

KQL Query

let admin_users = (IdentityInfo
  | summarize arg_max(TimeGenerated, *) by AccountUPN
  | where AssignedRoles contains "admin"
  | summarize by tolower(AccountUPN));
  SigninLogs
  | where TimeGenerated between(ago(14d)..ago(1d))
  | where ResultType == 0
  | where tolower(UserPrincipalName) in (admin_users)
  | where HomeTenantId != ResourceTenantId
  | summarize by UserPrincipalName, ResourceTenantId
  | join kind=rightanti (SigninLogs
  | where TimeGenerated > ago(1d)
  | where ResultType == 0
  | where tolower(UserPrincipalName) in (admin_users)
  | where HomeTenantId != ResourceTenantId
  | where isnotempty(HomeTenantId) and isnotempty(ResourceTenantId)) on UserPrincipalName, ResourceTenantId
  | where RiskLevelAggregated != "none"

Analytic Rule Definition

id: 3a0447c1-7f43-43d0-aeac-d5e1247964a8
name: Administrators Authenticating to Another Microsoft Entra ID Tenant
description: |
  'Detects when a privileged user account successfully authenticates from to another Microsoft Entra ID Tenant.
    Authentication attempts should be investigated to ensure the activity was legitimate and if there is other similar activity.
    Ref: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-user-accounts#monitoring-for-successful-unusual-sign-ins'
requiredDataConnectors:
  - connectorId: AzureActiveDirectory
    dataTypes:
      - SigninLogs
  - connectorId: BehaviorAnalytics
    dataTypes:
      - IdentityInfo
tactics:
  - InitialAccess
relevantTechniques:
  - T1078.004
query: |
  let admin_users = (IdentityInfo
    | summarize arg_max(TimeGenerated, *) by AccountUPN
    | where AssignedRoles contains "admin"
    | summarize by tolower(AccountUPN));
    SigninLogs
    | where TimeGenerated between(ago(14d)..ago(1d))
    | where ResultType == 0
    | where tolower(UserPrincipalName) in (admin_users)
    | where HomeTenantId != ResourceTenantId
    | summarize by UserPrincipalName, ResourceTenantId
    | join kind=rightanti (SigninLogs
    | where TimeGenerated > ago(1d)
    | where ResultType == 0
    | where tolower(UserPrincipalName) in (admin_users)
    | where HomeTenantId != ResourceTenantId
    | where isnotempty(HomeTenantId) and isnotempty(ResourceTenantId)) on UserPrincipalName, ResourceTenantId
    | where RiskLevelAggregated != "none"
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: UserPrincipalName
version: 1.0.1

Required Data Sources

Sentinel TableNotes
IdentityInfoEnsure this data connector is enabled
SigninLogsEnsure this data connector is enabled

MITRE ATT&CK Context

References

False Positive Guidance

Original source: https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/SigninLogs/AdministratorsAuthenticatingtoAnotherAzureADTenant.yaml