Entra ID OAuth user_impersonation Scope for Unusual User and Client

Last updated 22 days ago on 2026-08-12

Created a year ago on 2025-07-03

About

Identifies rare occurrences of OAuth workflow for a user principal that is single factor authenticated, with an OAuth scope containing user_impersonation for a token issued by Entra ID. Adversaries may use this scope to gain unauthorized access to user accounts, particularly when the sign-in session status is unbound, indicating that the session is not associated with a specific device or session. This behavior is indicative of potential account compromise or unauthorized access attempts. This rule flags when this pattern is detected for a user principal that has not been seen in the last 10 days, indicating potential abuse or unusual activity.

Tags

Domain: CloudDomain: IdentityUse Case: Threat DetectionData Source: AzureData Source: Microsoft Entra IDData Source: Microsoft Entra ID Sign-in LogsPlatform: Entra IDTactic: Initial AccessTactic: Defense EvasionRule Type: New TermsLanguage: kuery

Severity

medium

Risk Score

MITRE ATT&CK™

Initial Access (TA0001)(external, opens in a new tab or window)

↳ Valid Accounts (T1078)(external, opens in a new tab or window)

Defense Evasion (TA0005)(external, opens in a new tab or window)

↳ Use Alternate Authentication Material (T1550)(external, opens in a new tab or window)

↳ Impersonation (T1656)(external, opens in a new tab or window)

License

Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type: New Terms Rule
Integration Pack: Prebuilt Security Detection Rules
Index Patterns: filebeat-*logs-azure.signinlogs-*
Related Integrations: azure(external, opens in a new tab or window)
Query

✄𐘗text code block:
✄𐘗data_stream.dataset:azure.signinlogs and
azure.signinlogs.properties.authentication_processing_details:(*user_impersonation* and not *restricted_user_impersonation*) and
azure.signinlogs.properties.authentication_requirement:singleFactorAuthentication and
azure.signinlogs.properties.token_issuer_type:AzureAD and
azure.signinlogs.properties.token_protection_status_details.sign_in_session_status:unbound and
azure.signinlogs.properties.user_type:Member and
azure.signinlogs.properties.conditional_access_status:"notApplied" and
not user_agent.original:(Microsoft*Authentication*iPhone* or Mozilla*PKeyAuth/1.0) and
not azure.signinlogs.properties.device_detail.operating_system:(Android* or Ios*) and
event.outcome:success and
not azure.signinlogs.properties.app_id:(
    0000000c-0000-0000-c000-000000000000 or
    0a5f63c0-b750-4f38-a71c-4fc0d58b89e2 or
    48af08dc-f6d2-435f-b2a7-069abd99c086 or
    5e3ce6c0-2b1f-4285-8d4b-75ee78787346 or
    65d91a3d-ab74-42e6-8a2f-0add61688c74 or
    66a88757-258c-4c72-893c-3e8bed4d6899 or
    6bc3b958-689b-49f5-9006-36d165f30e00 or
    8c59ead7-d703-4a27-9e55-c96a0054c8d2 or
    95de633a-083e-42f5-b444-a4295d8e9314 or
    ab9b8c07-8f02-4f72-87fa-80105867a763 or
    cc15fd57-2c6c-4117-a88c-83b1d56b4bbe or
    d52792f4-ba38-424d-8140-ada5b883f293 or
    e8be65d6-d430-4289-a665-51bf2a194bda or
    fc0f3af4-6835-4174-b806-f7db311fd2f3
) and
not (
    azure.signinlogs.properties.resource_id:c2ada927-a9e2-4564-aae2-70775a2fa0af and
    (
        azure.signinlogs.properties.app_id:00000002-0000-0ff1-ce00-000000000000 and
        azure.signinlogs.properties.device_detail.operating_system:Windows or
        azure.signinlogs.properties.app_id:5f00fd34-f302-417f-81ef-1adda179d8fd and
        azure.signinlogs.properties.device_detail.operating_system:Windows*
    ) and
    azure.signinlogs.properties.device_detail.is_managed:true and
    azure.signinlogs.properties.device_detail.is_compliant:true and
    azure.signinlogs.properties.device_detail.trust_type:("Azure AD joined" or "Hybrid Azure AD joined") and
    azure.signinlogs.properties.device_detail.device_id:(* and not "") and
    azure.signinlogs.properties.incoming_token_type:none and
    azure.signinlogs.properties.client_app_used:Browser and
    azure.signinlogs.category:NonInteractiveUserSignInLogs
)

Install detection rules in Elastic Security

Detect Entra ID OAuth user_impersonation Scope for Unusual User and Client in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).