Entra ID Windows Hello for Business Credential Registered

Last updated a month ago on 2026-08-07

Created a month ago on 2026-08-07

About

Identifies the first-seen registration of a Windows Hello for Business (WHfB) credential for a Microsoft Entra ID user from a given source ASN in a tenant, based on a prefixed historic window. Enrollment is commonly part of legitimate onboarding or passwordless rollout and is not inherently malicious. Adversaries who have obtained a token that satisfies fresh (NGC) multi-factor authentication, for example by borrowing an existing WHfB key or passkey, can also enroll their own WHfB credential to establish durable, phishing-resistant persistence that survives password resets and standard session revocation. Correlate first-seen enrollments with the sign-in and device state that preceded them.

Tags

Domain: CloudDomain: IdentityPlatform: Entra IDUse Case: Identity and Access AuditUse Case: Threat DetectionTactic: PersistenceRule Type: New TermsData Source: AzureData Source: Microsoft Entra IDData Source: Microsoft Entra ID Audit LogsLanguage: kuery

Severity

low

Risk Score

MITRE ATT&CK™

Persistence (TA0003)(external, opens in a new tab or window)

↳ Account Manipulation (T1098)(external, opens in a new tab or window)

False Positive Examples

Legitimate WHfB and passwordless onboarding commonly generate this event, especially for new users or users enrolling from a new network ASN. This rule fires only on first-seen combinations of tenant, user, and source ASN over 14 days. Investigate unexpected ASNs, users outside the enrollment population, or enrollments preceded by anomalous sign-ins.

License

Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type: New Terms Rule
Integration Pack: Prebuilt Security Detection Rules
Index Patterns: logs-azure.auditlogs-*
Related Integrations: azure(external, opens in a new tab or window)
Query

✄𐘗text code block:
✄𐘗data_stream.dataset: "azure.auditlogs" and
    azure.auditlogs.operation_name: "Add Windows Hello for Business credential" and
    event.outcome: ("Success" or "success") and
    azure.tenant_id: * and
    azure.auditlogs.properties.initiated_by.user.userPrincipalName: * and
    source.as.number: *

Install detection rules in Elastic Security

Detect Entra ID Windows Hello for Business Credential Registered in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).