← Back to SOC feed Coverage →

Federated domain added to Entra ID tenant

kql MEDIUM Azure-Sentinel
T1484.002
AuditLogs
backdoorhuntingmicrosoftofficialpersistence
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Azure-Sentinel →
Retrieved: 2026-05-26T11:00:01Z · Confidence: medium

Hunt Hypothesis

Attackers may be attempting to establish persistence by adding a federated domain to an Entra ID tenant to forge authentication tokens and gain unauthorized access. SOC teams should proactively hunt for this behavior as it indicates potential adversary efforts to compromise identity infrastructure and maintain long-term access within the Azure environment.

KQL Query

let timeframe = 14d;
AuditLogs
| where TimeGenerated >= ago(timeframe)
| where OperationName =~ "Set domain authentication"
| where Result =~ "success"
| extend DomainName = tostring(TargetResources[0].displayName)
| extend DomainId   = tostring(TargetResources[0].id)
| extend ActorUpn   = tostring(InitiatedBy.user.userPrincipalName)
| extend ActorApp   = tostring(InitiatedBy.app.displayName)
| extend ActorIp    = iff(
      isnotempty(tostring(InitiatedBy.user.ipAddress)),
      tostring(InitiatedBy.user.ipAddress),
      tostring(InitiatedBy.app.ipAddress))
| extend Actor = iff(isnotempty(ActorUpn), ActorUpn, ActorApp)
| mv-expand ModProp = TargetResources[0].modifiedProperties
| extend PropName = tostring(ModProp.displayName)
| extend OldValue = tostring(ModProp.oldValue)
| extend NewValue = tostring(ModProp.newValue)
// Surface transitions to federated authentication only
| where NewValue has_any ("Federated", "federated")
| extend AccountName      = iff(ActorUpn has "@",
      tostring(split(ActorUpn, "@")[0]), Actor)
| extend AccountUPNSuffix = iff(ActorUpn has "@",
      tostring(split(ActorUpn, "@")[1]), "")
| project
    TimeGenerated,
    DomainName,
    DomainId,
    PropName,
    OldValue,
    NewValue,
    Actor,
    AccountName,
    AccountUPNSuffix,
    ActorIp,
    CorrelationId
| sort by TimeGenerated desc

Analytic Rule Definition

id: 902e4b5a-4e6a-46e1-a897-4cdbda0693b3
name: Federated domain added to Entra ID tenant
description: Identifies federation configuration changes to Entra ID domains, a persistence technique that allows attackers to forge authentication tokens for any user account in the tenant without knowing their password.
requiredDataConnectors:
  - connectorId: AzureActiveDirectory
    dataTypes:
      - AuditLogs
tactics:
  - DefenseEvasion
  - Persistence
  - PrivilegeEscalation
relevantTechniques:
  - T1484.002
query: |
  let timeframe = 14d;
  AuditLogs
  | where TimeGenerated >= ago(timeframe)
  | where OperationName =~ "Set domain authentication"
  | where Result =~ "success"
  | extend DomainName = tostring(TargetResources[0].displayName)
  | extend DomainId   = tostring(TargetResources[0].id)
  | extend ActorUpn   = tostring(InitiatedBy.user.userPrincipalName)
  | extend ActorApp   = tostring(InitiatedBy.app.displayName)
  | extend ActorIp    = iff(
        isnotempty(tostring(InitiatedBy.user.ipAddress)),
        tostring(InitiatedBy.user.ipAddress),
        tostring(InitiatedBy.app.ipAddress))
  | extend Actor = iff(isnotempty(ActorUpn), ActorUpn, ActorApp)
  | mv-expand ModProp = TargetResources[0].modifiedProperties
  | extend PropName = tostring(ModProp.displayName)
  | extend OldValue = tostring(ModProp.oldValue)
  | extend NewValue = tostring(ModProp.newValue)
  // Surface transitions to federated authentication only
  | where NewValue has_any ("Federated", "federated")
  | extend AccountName      = iff(ActorUpn has "@",
        tostring(split(ActorUpn, "@")[0]), Actor)
  | extend AccountUPNSuffix = iff(ActorUpn has "@",
        tostring(split(ActorUpn, "@")[1]), "")
  | project
      TimeGenerated,
      DomainName,
      DomainId,
      PropName,
      OldValue,
      NewValue,
      Actor,
      AccountName,
      AccountUPNSuffix,
      ActorIp,
      CorrelationId
  | sort by TimeGenerated desc
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: Actor
      - identifier: Name
        columnName: AccountName
      - identifier: UPNSuffix
        columnName: AccountUPNSuffix
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: ActorIp
  - entityType: DNS
    fieldMappings:
      - identifier: DomainName
        columnName: DomainName
version: 1.0.0
metadata:
    source:
        kind: Community
    author:
        name: descambiado
    support:
        tier: Community
    categories:
        domains: [ "Security - Threat Protection", "Identity" ]

Required Data Sources

Sentinel TableNotes
AuditLogsEnsure this data connector is enabled

MITRE ATT&CK Context

References

False Positive Guidance

Original source: https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/AuditLogs/FederatedDomainAddedToTenant.yaml