Microsoft Entra ID on sentinelchangelog.nethttp://sentinelchangelog.net/tags/microsoft-entra-id/Recent content in Microsoft Entra ID on sentinelchangelog.netHugo -- 0.157.0enWed, 03 Jun 2026 06:01:01 +0000Microsoft Agent Identities Connector: New Entra Non-Human Identity Asset Visibility (Preview)http://sentinelchangelog.net/posts/2026-06-03-pr-14326/Wed, 03 Jun 2026 06:01:01 +0000http://sentinelchangelog.net/posts/2026-06-03-pr-14326/Agent 365 solution adds new Microsoft Agent Identities connector for tracking agent blueprints and non-human identity assets across four data tables.Entra ID Post-Credential Activity Detection: Service Principal Staging and Privileged Role Escalationhttp://sentinelchangelog.net/posts/2026-05-29-pr-14299/Fri, 29 May 2026 10:56:48 +0000http://sentinelchangelog.net/posts/2026-05-29-pr-14299/Three new hunting queries target Midnight Blizzard-style persistence patterns — service principal credential staging, privileged role assignments to new accounts, and Temporary Access Pass abuse.Entra ID Identity Boundary Expansion: Three New Hunting Queries for Stealthy Persistencehttp://sentinelchangelog.net/posts/2026-05-28-pr-14307/Thu, 28 May 2026 11:14:14 +0000http://sentinelchangelog.net/posts/2026-05-28-pr-14307/Added three hunting queries targeting identity boundary expansion techniques in Entra ID that escalate privileges without creating new accounts.Entra ID Authentication Anomalies: Advanced Hunting for Privilege Abuse and Defense Evasionhttp://sentinelchangelog.net/posts/2026-05-27-pr-14339/Wed, 27 May 2026 13:42:33 +0000http://sentinelchangelog.net/posts/2026-05-27-pr-14339/Adds three-query pack detecting legacy auth bypass, guest account abuse, and post-reset privileged operations.Entra ID Account Takeover: Three-Query Hunting Pack for Post-Compromise Detectionhttp://sentinelchangelog.net/posts/2026-05-27-pr-14335/Wed, 27 May 2026 13:41:06 +0000http://sentinelchangelog.net/posts/2026-05-27-pr-14335/Adds hunting pack targeting device code phishing, service principal persistence, and bulk password resets by privileged actors.Microsoft Entra ID OAuth Consent Query: Fixing Zero-Result Bug in High-Risk Permission Detectionhttp://sentinelchangelog.net/posts/2026-05-27-pr-14334/Wed, 27 May 2026 13:38:30 +0000http://sentinelchangelog.net/posts/2026-05-27-pr-14334/Corrects broken hunting query that returned no results due to incorrect property name filter.Entra ID Attack Chain Correlation: Three New Hunting Queries for Sequential Compromise Patternshttp://sentinelchangelog.net/posts/2026-05-26-pr-14311/Tue, 26 May 2026 08:14:04 +0000http://sentinelchangelog.net/posts/2026-05-26-pr-14311/Three hunting queries detect multi-event attack chains in Entra ID—privileged role grants followed by SP credential additions and MFA disabling followed by sign-ins from unknown IPs.Entra ID Hunting Pack: Defense Weakening and Privilege Abuse Detectionhttp://sentinelchangelog.net/posts/2026-05-26-pr-14240/Tue, 26 May 2026 06:12:52 +0000http://sentinelchangelog.net/posts/2026-05-26-pr-14240/Three hunting queries targeting silent defense weakening techniques and off-hours privilege escalation in Entra ID environments.Entra ID Workload Identity and Privileged Role Hunting Pack: Three New Detection Querieshttp://sentinelchangelog.net/posts/2026-05-21-pr-14281/Thu, 21 May 2026 12:50:47 +0000http://sentinelchangelog.net/posts/2026-05-21-pr-14281/New hunting pack targeting workload identity abuse and privileged role assignment anomalies with coverage gaps for service principal credential theft and PIM bypass techniques.Entra ID Cross-Source Hunting Pack: Post-Compromise Pattern Detectionhttp://sentinelchangelog.net/posts/2026-05-19-pr-14262/Tue, 19 May 2026 10:09:11 +0000http://sentinelchangelog.net/posts/2026-05-19-pr-14262/Three new hunting queries correlate AuditLogs and SigninLogs to surface post-compromise identity patterns using baseline-driven anomaly detection.Microsoft Entra ID Table Rename: Hunting Queries Updated for Current Schemahttp://sentinelchangelog.net/posts/2026-05-18-pr-14186/Mon, 18 May 2026 05:36:36 +0000http://sentinelchangelog.net/posts/2026-05-18-pr-14186/12 hunting queries updated to use EntraIdSignInEvents and EntraIdSpnSignInEvents tables, replacing deprecated AADSignInEventsBeta and AADSpnSignInEventsBeta references.Entra ID Attack Chain Detection: 5 New Hunting Queries Target Application Layer Persistencehttp://sentinelchangelog.net/posts/2026-05-13-pr-14239/Wed, 13 May 2026 10:29:56 +0000http://sentinelchangelog.net/posts/2026-05-13-pr-14239/Five hunting queries expose OAuth consent abuse, privileged escalation, and Conditional Access evasion used in Midnight Blizzard and Storm-0558 campaigns.Microsoft Entra ID Protection: Enhanced Detection Logic Filters Out Admin Risk Eventshttp://sentinelchangelog.net/posts/2026-05-12-pr-14108/Tue, 12 May 2026 08:58:14 +0000http://sentinelchangelog.net/posts/2026-05-12-pr-14108/Updated CorrelateIPC_Unfamiliar-Atypical rule adds filtering to exclude admin-triggered atypical travel alerts, improving detection precision.Microsoft Entra ID: Service Principal Credential Manipulation by Rare Actorshttp://sentinelchangelog.net/posts/2026-05-07-pr-14213/Thu, 07 May 2026 10:51:04 +0000http://sentinelchangelog.net/posts/2026-05-07-pr-14213/Identifies service principal credential additions by actors not observed performing these operations in the previous 90 days, targeting persistence techniques.Microsoft Entra ID: Hunting Query for Password Spraying Detection via IP Failure Burstshttp://sentinelchangelog.net/posts/2026-05-07-pr-14208/Thu, 07 May 2026 10:50:43 +0000http://sentinelchangelog.net/posts/2026-05-07-pr-14208/Correlates failed sign-ins across multiple identities followed by successful authentication from the same IP within 15 minutes, targeting password spraying patterns.Microsoft Entra ID: New Hunting Query Detects Post-Compromise Token Abuse via ASN Mismatcheshttp://sentinelchangelog.net/posts/2026-05-07-pr-14207/Thu, 07 May 2026 10:50:16 +0000http://sentinelchangelog.net/posts/2026-05-07-pr-14207/Surfaces rapid ASN changes between interactive and non-interactive sign-ins within 10 minutes, indicating potential post-compromise token misuse.Entra ID Brute Force Detection: Renamed for Broader Windows Device Coveragehttp://sentinelchangelog.net/posts/2026-04-30-pr-14162/Thu, 30 Apr 2026 11:04:41 +0000http://sentinelchangelog.net/posts/2026-04-30-pr-14162/Analytic rule renamed from Cloud PC-specific to cover all Entra-authenticated Windows devices, clarifying detection scope without logic changes.Microsoft Entra ID Conditional Access Bypass Detection: False Positive Reduction via Benign Status Code Watchlisthttp://sentinelchangelog.net/posts/2026-04-14-pr-14016/Tue, 14 Apr 2026 10:34:59 +0000http://sentinelchangelog.net/posts/2026-04-14-pr-14016/New watchlist filters out 7 known-benign status codes from Conditional Access bypass detection to reduce false positives from legitimate MFA prompts and session expiration events.Microsoft Entra ID: Account Creation/Deletion Detection Enhanced Against Timing Evasionhttp://sentinelchangelog.net/posts/2026-04-13-pr-14049/Mon, 13 Apr 2026 10:07:13 +0000http://sentinelchangelog.net/posts/2026-04-13-pr-14049/Critical improvements to AccountCreatedandDeletedinShortTimeframe rule extend detection window to 7 days and use immutable UserID correlation to prevent timing-based evasion techniques.Microsoft Entra ID Assets: Device and Organizational Contact Visibility Expansionhttp://sentinelchangelog.net/posts/2026-03-11-pr-13766/Wed, 11 Mar 2026 05:07:17 +0000http://sentinelchangelog.net/posts/2026-03-11-pr-13766/Two new asset tables (EntraDevices, EntraOrgContacts) added to Microsoft Entra ID connector for BloodHound graph building and complete asset enumeration.Documentation Fix: Broken Links Resolved in Microsoft Entra ID and Network Session Essentialshttp://sentinelchangelog.net/posts/2026-02-06-pr-13510/Fri, 06 Feb 2026 09:21:39 +0000http://sentinelchangelog.net/posts/2026-02-06-pr-13510/Customer-reported broken links fixed in analytic rule descriptions with corrected MITRE technique references and restored documentation.Microsoft Entra ID: New Conditional Access Security Insights and Monitoring Workbookhttp://sentinelchangelog.net/posts/2025-12-19-pr-13313/Fri, 19 Dec 2025 20:29:56 +0000http://sentinelchangelog.net/posts/2025-12-19-pr-13313/New Conditional Access SISM workbook added to provide comprehensive CA policy monitoring and Zero Trust analytics.SOX IT Compliance Solution Released: IT Change Monitoring for Financial Controlshttp://sentinelchangelog.net/posts/2025-12-17-pr-13298/Wed, 17 Dec 2025 05:28:36 +0000http://sentinelchangelog.net/posts/2025-12-17-pr-13298/New compliance monitoring solution provides IT systems change tracking and segregation of duties controls for Sarbanes-Oxley compliance programs.Microsoft Entra ID Playbooks: API Permission Updates for Session Revocationhttp://sentinelchangelog.net/posts/2025-12-15-pr-13236/Mon, 15 Dec 2025 12:07:03 +0000http://sentinelchangelog.net/posts/2025-12-15-pr-13236/Updates Revoke-AADSignInSessions playbook documentation to use correct User.RevokeSessions.All permissions instead of broader User.ReadWrite.All.Microsoft Entra ID Assets: Fixing Product Name Typo in Data Connectorhttp://sentinelchangelog.net/posts/2025-10-29-pr-12955/Wed, 29 Oct 2025 08:22:42 +0000http://sentinelchangelog.net/posts/2025-10-29-pr-12955/Fixed typo in Microsoft Entra ID Assets connector title and updated description to use correct Microsoft Sentinel branding.GDPR Compliance Dashboard: New Workbook for Privacy Risk Monitoringhttp://sentinelchangelog.net/posts/2025-10-09-pr-12933/Thu, 09 Oct 2025 12:04:16 +0000http://sentinelchangelog.net/posts/2025-10-09-pr-12933/New GDPR Compliance solution adds workbook consolidating privacy risk signals from Defender XDR, Microsoft Purview, Azure SQL, and Entra ID.Microsoft Entra ID Assets Solution: New Data Risk Graph Foundation for Purview Integrationhttp://sentinelchangelog.net/posts/2025-09-25-pr-12810/Thu, 25 Sep 2025 05:53:40 +0000http://sentinelchangelog.net/posts/2025-09-25-pr-12810/New Microsoft Entra ID Assets connector provides supplemental asset data for enhanced activity insights and data risk graph capabilities in Microsoft Purview.Microsoft Entra ID Connector: Preview Labels Removed from GA Data Typeshttp://sentinelchangelog.net/posts/2025-09-23-pr-12770/Tue, 23 Sep 2025 10:02:25 +0000http://sentinelchangelog.net/posts/2025-09-23-pr-12770/Entra ID connector updated to remove preview designations from data types that have reached general availability.Microsoft Entra ID Conditional Access Rules: Incident Configuration Fix Resolves Rule Creation Failureshttp://sentinelchangelog.net/posts/2025-08-29-pr-12717/Fri, 29 Aug 2025 08:18:56 +0000http://sentinelchangelog.net/posts/2025-08-29-pr-12717/Microsoft Entra ID Conditional Access detection rules updated to fix lookbackDuration format preventing rule deployment in Microsoft Sentinel workspaces.