Entra ID Microsoft Authentication Broker Sign-In to Unusual Resource

Last updated 5 days ago on 2026-05-15

Created 5 days ago on 2026-05-15

About

Detects successful Microsoft Entra ID sign-ins where the client application is the Microsoft Authentication Broker (MAB) and the requested resource identifier is outside a short list of commonly observed first-party targets. Attackers abuse the broker in phishing and token broker flows to obtain tokens for unexpected APIs or enterprise applications. The exclusion list covers legacy Azure Active Directory, Microsoft Graph, Device Registration Service, Microsoft Intune Enrollment, extend or tune exclusions for your tenant after baselining broker traffic.

Tags

Domain: CloudDomain: IdentityData Source: AzureData Source: Microsoft Entra IDData Source: Microsoft Entra ID Sign-in LogsUse Case: Threat DetectionTactic: Initial AccessLanguage: kuery

Severity

medium

Risk Score

MITRE ATT&CK™

Initial Access (TA0001)(external, opens in a new tab or window)

↳ Valid Accounts (T1078)(external, opens in a new tab or window)

Defense Evasion (TA0005)(external, opens in a new tab or window)

↳ Use Alternate Authentication Material (T1550)(external, opens in a new tab or window)

False Positive Examples

Legitimate broker sign-ins to first-party Microsoft resources that use alternate well-known IDs, regional variants, or new Microsoft services not yet in the exclusion list may match. Third-party applications that integrate with MAB for delegated authentication can also appear. Baseline `resource_id` and `resource_display_name` for your environment and add exclusions for approved resources.

License

Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type: Query (Kibana Query Language)
Integration Pack: Prebuilt Security Detection Rules
Index Patterns: logs-azure.signinlogs-*
Related Integrations: azure(external, opens in a new tab or window)
Query

✄𐘗text code block:
✄𐘗data_stream.dataset:"azure.signinlogs" and event.category:"authentication" and event.action:"Sign-in activity" and
event.outcome:success and azure.signinlogs.properties.app_id:"29d9ed98-a469-4536-ade2-f981bc1d605e" and
azure.signinlogs.properties.resource_id:(* and not 
    ("00000002-0000-0000-c000-000000000000" or
    "90a2e5d2-fd7a-4a2e-bc90-3dc50ae8e3ee" or
    "01cb2876-7ebd-4aa4-9cc9-d28bd4d359a9" or
    "d4ebce55-015a-49b5-a083-c84d1797ae8c" or
    "00000003-0000-0000-c000-000000000000" or 
    "0a5f63c0-b750-4f38-a71c-4fc0d58b89e2")
)

Install detection rules in Elastic Security

Detect Entra ID Microsoft Authentication Broker Sign-In to Unusual Resource in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).