Daily Defender News
Aboutmerill.net
Microsoft Defender for Identity
Identity protection

Alerts Xdr

26 October 2026Doc update+0 / −11 lines

In brief

The page no longer lists alerts including NEGOEX relay attack, suspicious Okta account enumeration, OAuth app created a user, suspicious Entra role addition, and seven other entries.

What Defender admins need to know

Review internal alert catalogs or runbooks that reference these entries; no administrator action is specified.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

| Malicious sign in from a randomized user agent
Description:A user's credentials were intercepted from an unusual user agent. This user agent has recently been observed in a sign-in pattern related to adversary-in-the-middle and password spraying attacks. We recommend that you promptly investigate this alert, as an attacker might already be using the stolen credentials to move laterally in the network. | High | T1539, T1110.003, T1110.001 | xdr_AnomalousRandomUASignIn | | Multiple failed Okta authentication attempts detected
Description:Multiple failed Okta authentication attempts were detected for user {AccountUpn}. A total of {TotalFailedRequestCounts} failed attempts originated from IP address {IPAddress} within a 2 minute window. The attempts involved authentication actions {ActionType}. This activity indicates a brute force attack or credential stuffing attempt. The user agent string {UserAgent} was used across all attempts. | High | T1110 | xdr_OktaMultipleFailedLogons | | Multiple failed Okta sign in attempts followed by successful sign in with anomalous user behavior
Description:Multiple failed sign-in attempts followed by a successful sign-in were observed for user {AccountUpn} within a short time span. The activity included high-risk properties {RiskyBehaviors}, classified by Okta as {RiskLevel}. All sign-in attempts originated from a single IP address {IPAddress}. | High | T1110, T1078 | xdr_OktaMultipleFailedLogonsFollowedBySignIn | | NEGOEX relay attack
Description:An attacker used NEGOEX to impersonate a server that a client wants to connect to so that the attacker can then relay the authentication process to any target. This allows the attacker to gain access to the target. NEGOEX is an authentication protocol designed to authenticate user accounts to Microsoft Entra joined devices. | High | T1187, T1557.001 | xdr_NegoexRelayAttack | | Okta access or refresh token grant from a risky context
Description:An Okta OAuth access or refresh token was successfully granted in a context flagged by Okta's threat or risk indicators. This activity might indicate unauthorized token issuance, which could allow an attacker to maintain access without reentering credentials. | Medium | T1528 | xdr_OktaTokenGrantsFromRiskyContext | | Okta FastPass phishing attack detected
Description:A successful Okta FastPass phishing attack was detected for user {AccountUpn}. An initial phishing attempt was declined at {phishingAttemptTime}, but the compromised session {SessionId} was later used for authentication actions at {Timestamp}. The session originated from IP address {PhishingIPAddress} and was subsequently reused from {ReuseIPAddress} with user agent {ReuseUserAgent}. Risk level: {SessionReuseRisk}. | High | T1539, T1550.004 | xdr_OktaFastPassPhishingAttempt | | Okta privileged role assigned to application
Description:{ActorAliasName} assigned {RoleDisplayName} role to application: {ApplicationDisplayName} | High | T1098.003 | xdr_OktaPrivilegedRoleAssignedToApplication | | Attempt to disable Defender for Identity service principal observed
Description:An actor attempted to disable or impair the security application responsible for generating identity and authentication alerts. This behavior is consistent with adversaries seeking to evade detection after initial access, maintain persistence, or disrupt monitoring by modifying, stopping, or uninstalling security services. Such activity often occurs following credential compromise, privilege escalation, or lateral movement. | High | T1562.001 | xdr_SuspectedMDITampering | | Skipped MFA on remembered device from uncommon ISP sign-in
Description:A suspicious Microsoft Entra sign-in from an internet service provider (ISP) the account hasn't used in the past 30 days skipped multi-factor authentication (MFA) on a remembered device. This indicates that an attacker might have used a stolen persistent cookie replayed from the attacker's infrastructure instead of the user's normal network. It's important to investigate and mitigate this urgently because skipped MFA could lead to potential security risks such as unauthorized access, session hijacking, and data breach. | Medium | T1550.004, T1078.004 | xdr_SuspiciousMfaSkip | | Suspicious access denial to view primary group ID of an object
Description:An access control list (ACL) denied access to view the primary group ID of an object. An attacker might have compromised a user account and is looking to hide the group of a backdoor user. | Medium | T1564.002 | xdr_SuspiciousDenyAccessToPrimaryGroupId | | Suspicious property lock deactivated on Microsoft Entra application
Description:The servicePrincipalLockConfiguration.isEnabled property of a Microsoft Entra application or one of its associated service principals was modified. Disabling this lock removes essential built-in protections that guard against unauthorized credential rotation, redirect URI tampering, and illicit permission grants. Changes to this setting are rare during standard administrative operations and often signal suspicious activity. Threat actors can deliberately disable the lock to weaken the application's security posture, creating an opening for lateral movement or privilege escalation within the environment. | Medium | T1562.001, T1671 | xdr_SuspiciousPropertyLockEntra |

Discovery alerts

| Suspicious Entra Connect account authentication
Description:A suspicious authentication by an Entra Connect account originating from the IP address {SourceIpAddress} was detected. This authentication is anomalous because it does not match typical Entra Connect activity and is therefore suspected to originate from a non-Entra Connect server. This might indicate that the Entra Connect account has been compromised and is being used by an attacker to leverage its permissions for attacks such as DCSync. | High | T1078, T1556.007 | xdr_SuspiciousEntraConnectAccountAuthentication | | Suspicious Entra cookie request from suspicious IP address
Description:A successful sign-in originating from a threat intelligence (TI)-associated IP address attempted to request a Primary Refresh Token (PRT) cookie in Microsoft Entra. This activity may indicate an attacker-controlled host attempting to abuse PRT authentication. | Medium | T1078.001 | xdr_SuspiciousEntraSignIn | | Suspicious Graph API request made from Entra ID sync application
Description:An unexpected Graph API request made by Entra ID synchronization service application was detected. This behavior might indicate that the application was compromised and is being used for malicious activities. Go through the recommended actions to investigate immediately and mitigate associated risks. | Medium | T1087, T1069 | xdr_SuspiciousConnectSyncProvisioningGraphAPIActivity | | Suspicious Okta account enumeration
Description:A suspicious IP address enumerated Okta accounts. An attacker might be attempting to perform discovery activities for later follow-on behavior. | High | T1078.004 | xdr_SuspiciousOktaAccountEnumeration | | Suspicious OneLogin MFA fatigue
Description:A suspicious IP address sent several OneLogin multifactor authentication (MFA) challenge attempts for a user account. An attacker might have compromised the user's account credentials and is trying to flood and bypass the MFA mechanism. | Medium | T1110.003 | xdr_OneLoginMfaFatigue | | Suspicious sign-in from an unusual user agent and IP address
Description:A successful sign-in using an uncommon user agent and a potentially malicious IP address was detected in Microsoft Entra. This activity may indicate a password spray or credential stuffing attack originating from the attacker-controlled IP, or in rare cases, a compromised account being used for unauthorized access. | Medium | T1078.001 | xdr_SuspiciousEntraSignIn | | Suspicious sign-in from an unusual user agent and IP address using device code flow
Description:A successful sign-in was detected using an uncommon or atypical user agent combined with a potentially risky IP address. This pattern is frequently associated with password spray, credential stuffing, or other unauthorized authentication attempts originating from attacker-controlled infrastructure. In some cases, it may also indicate the use of compromised credentials for unauthorized access. | Medium | T1078.001 | xdr_SuspiciousEntraSignIn | | Suspicious sign-in from an unusual user agent and IP address using PowerShell
Description:A successful sign-in was detected using an uncommon or atypical user agent combined with a potentially risky IP address. This pattern is frequently associated with password spray, credential stuffing, or other unauthorized authentication attempts originating from attacker-controlled infrastructure. In some cases, it may also indicate the use of compromised credentials for unauthorized access. | Medium | T1078.001 | xdr_SuspiciousEntraSignIn | | Possible authentication silo bypass
Description:A possible attempt to bypass authentication silo policies and authenticate against a silo-protected service was detected on this device. | High | T1550 | xdr_PossibleAuthenticationSiloBypass | | Possible takeover of a Microsoft Entra seamless SSO account
Description:A Microsoft Entra seamless SSO (single sign-on) account object, AZUREADSSOACC, was modified suspiciously. An attacker might be moving laterally from the on-premises environment to the cloud. | High | T1556 | xdr_SuspectedAzureSsoAccountTakeover | | Suspected pass-the-ticket attack
Description:A Pass-the-Ticket (PtT), also known as a ticket replay attack, has been detected on this account. A ticket for the account {SourceAccountName} originating from the device {TargetDeviceName} has been re-used on the device {DeviceName}. In this attack, a threat actor steals a valid Kerberos authentication ticket and reuses it to access other devices across the network. By replaying the stolen ticket, the threat actor can impersonate the user, move through the network, and escalate privileges without needing the account password. | Medium | T1550 | xdr_PassTheTicketAttack | | Suspicious activity after password sync
Description:A user performed an uncommon action on an application after a recent password sync. An attacker might have compromised a user's account to perform malicious activities in the organization. | Medium | T1021.007 | xdr_SuspiciousActivityAfterPasswordSync | | Suspicious authentication attempt
Description:A suspicious authentication attempt has been observed. This anomalous authentication request is suspected to have been specially crafted by an attacker. The attacker might be using stolen hash or clear text password for authentication, possibly leveraging pass-the-hash or over-pass-the-hash attack. Investigate immediately to protect the account and organization from security breach. | Medium | T1550.002 | xdr_SuspiciousAuthAttempt | | Suspicious Kerberos SPN request
Description:A suspicious Kerberos SPN request has been observed. This anomalous request is suspected to have been specially crafted by an attacker. The attacker might be using stolen credentials from a compromised user and is leveraging them for a Kerberoasting attack. | Medium | T1558.003 | xdr_SuspiciousAuthAttempt | | Suspicious resource-based constrained delegation (RBCD) authentication
Description:A Kerberos authentication pattern consistent with Resource-Based Constrained Delegation (RBCD) abuse was detected. The account '{DelegatingMachine}' requested a Kerberos service ticket to '{ServiceName}' while impersonating user '{SourceAccountName}' via delegation. RBCD abuse is a sophisticated attack technique that allows an attacker to impersonate users when accessing services hosted on a targeted account. This behavior might indicate an attacker's attempt to achieve lateral movement, privilege escalation, and establish persistence within the organization. | Medium | T1558 | xdr_SuspiciousRBCDAuthentication | | Guest user account promoted to member
Description:A guest (external) user account was promoted to a member (internal) account. Guest accounts typically have restricted access, while member accounts are treated as internal users and may inherit broader permissions, access to resources, and eligibility for privileged roles. This can also be abused by adversaries to escalate privileges, bypass external access restrictions, or establish persistence within the tenant. | Medium | T1098 | xdr_GuestToMemberPromotion | | Malicious registration of a device with strong MFA
Description:A new Microsoft Authenticator device was registered to the account shortly after compromise, enabling persistent attacker access through an attacker controlled MFA method. | High | T1556.006, T1098.005 | xdr_MFADeviceRegistrationByCompromisedUser | | Multifactor authentication method added for a privileged Okta account
Description:A new multifactor authentication method was registered for {TargetAliasName}, a privileged Okta account. This activity might indicate that an attacker who compromised the account registered their own authenticator to maintain persistent access, allowing continued sign-in even after a password reset. Privileged accounts also enroll new authenticators for legitimate reasons, such as replacing a lost or upgraded device, so confirm whether the enrollment was expected. | Medium | T1556.006 | xdr_OktaPrivilegedAccountMfaAdded | | OAuth app created a user
Description:A new user account was created by an OAuth application. An attacker might have compromised this application for persistence in the organization. | Medium | T1136.003 | xdr_OAuthAppCreatedAUser | | Okta privileged API token created
Description:{ActorAliasName} created an API token. If stolen, it can grant the attacker access with the user's permission. | High | T1078.004 | xdr_OktaPrivilegedApiTokenCreated | | Okta privileged API token updated
Description:{ActorAliasName} updated a Privileged API token Configuration to be more promiscuous. If stolen, it can grant the attacker access with the user's permission. | High | T1078.004 | xdr_OktaPrivilegedApiTokenUpdated | | Password of a privileged Okta account was reset by another account
Description:Another identity reset the password for {TargetAliasName}, a privileged Okta account. This activity might indicate unauthorized administrative access and an attempt to take control of the privileged account. Unauthorized control of this account might provide access to its assigned roles and associated resources. Administrators and help desk staff also reset passwords for legitimate reasons, such as recovering a locked-out account, so confirm whether the reset was requested. | Medium | T1098 | xdr_OktaPrivilegedAccountPasswordReset | | Suspicious addition of default third‑party MFA method to user account
Description:A new third‑party multifactor authentication method was set as the default for a user account. Changing the default MFA provider could allow sign‑ins to be approved outside of the organization’s standard authentication flow and might indicate account manipulation intended to persist access or weaken enforcement. Go through the Recommendation section to immediately investigate and mitigate associated risks. | Medium | T1556.006 | xdr_Suspicious3rdPartyMfaAddition | | Suspicious addition of email
Description:New email was added for multiple users in a suspicious way. An attacker might have done this to gain persistence in the organization. | Medium | T1556.006 | xdr_SuspiciousMFAAddition | | Suspicious change to primary group ID
Description:A user's primary group ID was modified. An attacker might have compromised a user account and assigned a backdoor user with strong permissions in the domain for later use. | High | T1098 | xdr_SuspiciousChangeInUserPrimaryGroupId | | Suspicious credential change to an Entra Connect Sync application
Description:A user or another application modified credentials for a Microsoft Entra Connect Sync provisioning application. This activity might indicate that the application was compromised and could be used for malicious activities. | Low | T1098 | xdr_EntraConnectSyncAppCredentialChange | | Suspicious Entra device join or registration
Description:A user was suspiciously registered or joined into a new device to Entra. An attacker might have compromised the user account to perform persistence and lateral movement. Investigate immediately to mitigate associated security risks. | Medium | T1098.005 | xdr_SuspiciousAdditionOfEntraDevice | | Suspicious Entra device join or registration
Description:A user was suspiciously registered or joined into a new device to Entra, originating from an IP address identified by Microsoft Threat Intelligence. An attacker might have compromised the user account to perform persistence and lateral movement. Investigate immediately to mitigate associated security risks. | High | T1098.005 | xdr_SuspiciousDeviceRegistration | | Suspicious Entra role addition
Description:A user was suspiciously assigned to a sensitive role. An attacker might have compromised the user account to perform persistence and lateral movement. Investigate immediately to mitigate associated security risks. | Medium | T1098.003 | xdr_SuspiciousAdditionOfRoleToUser | | Suspicious Intune device registration activity
Description:Microsoft Entra ID detected a potentially suspicious device registration attempt in Microsoft Intune. The device enrollment activity deviates from normal user or organizational behavior and may indicate unauthorized device onboarding or account misuse. Review the registering user, device details, location, and authentication context to confirm whether the registration was legitimate. | Medium | T1098.005 | xdr_SuspiciousIntuneDeviceRegistration | | Suspicious MFA tampering activity by admin account
Description:An administrator account performed multifactor authentication (MFA) tampering activity after a risky authentication. An attacker might have compromised an admin account to manipulate MFA settings for possible lateral movement activity. | Low | T1556.006 | xdr_AdminAccountTakeover | | Suspicious removal of privileged app role assignment through Graph API
Description:A privileged app role assignment was deleted through Microsoft Graph API. This activity might indicate unauthorized removal or modification of application privileges. | High | T1114 | xdr_SuspiciousAppRoleAssignmentDeletion | | Suspicious service principal sign-in following credential addition
Description:Suspicious Service Principal sign-in detected, shortly after new credentials are added. Such activity may indicate application persistence, unauthorized credential implantation, privilege escalation, or Service Principal compromise. | Medium | T1098.001 | xdr_AnomalousSPNSignInAfterCredAddition | | Suspicious sign-in by a user exhibiting a spike in account update activity
Description:A user account that exhibited an unusual increase in account update operations, including changes to authentication methods such as the removal of multifactor authentication (MFA), was also observed performing a suspicious sign‑in activity. This pattern might indicate attempts to modify authentication settings or access the account in a manner consistent with unauthorized use. | Medium | T1098 | xdr_SuspiciousSpikeUserUpdate | | User was created and assigned to Global Administrator role
Description:A new user was created and assigned to Global Administrator role. An attacker might have compromised the user account to perform persistence and lateral movement. | High | T1136.003, T1098.003 | xdr_SuspiciousUserCreationAndSensitiveRoleAssignment | | User was created and assigned to sensitive role
Description:A new user was created and assigned to a sensitive role. An attacker might have compromised the user account to perform persistence and lateral movement. | Medium | T1136.003, T1098.003 | xdr_SuspiciousUserCreationAndSensitiveRoleAssignment |

Privilege Escalation alerts

| Suspected certificate enrollment abuse (ESC15)
Description:A certificate was enrolled suspiciously. An attacker might be using the ESC15 technique to exploit CVE-2024-49019 (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49019) and escalate privileges in the forest. | High | T1068 | xdr_SuspectedCertificateEnrollmentESC15 | | Suspicious Active Directory Certificate Services (AD CS) certificate request
Description:A suspicious certificate request was detected to Active Directory Certificate Services (AD CS) with anomalous characteristics that may indicate an attempt to abuse certificate enrollment for privilege escalation or impersonation of another identity. | High | T1649 | xdr_SuspiciousCertificateRequest | | Suspicious Active Directory Certificate Services (AD CS) misconfigured certificate template abuse (ESC1)
Description:A certificate request was detected using a template that allows the requester to supply arbitrary Subject Alternative Name (SAN) values. This may indicate an ESC1 Active Directory Certificate Services (AD CS) abuse attack, in which an attacker requests a certificate capable of authentication (Client Authentication / PKINIT) and impersonates another user or privileged account, potentially gaining unauthorized access to domain resources. | High | T1649 | xdr_AdcsMisconfigTemplateAbuseEsc1 | | Suspicious addition and removal of elevated privileges
Description:A high-privilege Entra ID role (for example, Global Administrator or Privileged Role Administrator) was granted to user or service principal and was quickly revoked after. This rapid role assignment and removal pattern is uncommon in regular administrative workflows and might indicate an attempt to evade detection during privilege escalation. Investigate this alert immediately to prevent or mitigate any unauthorized access, privilege escalation, and security breach. | Medium | T1078.004 | xdr_SuspiciousAdditionAndRemovalOfPrivilegedRole | | Suspicious SPN was added to a user
Description:A suspicious service principal name (SPN) was added to a sensitive user. An attacker might be attempting to gain elevated access for lateral movement within the organization. | High | T1098 | xdr_SuspiciousAdditionOfSpnToUser |

Exfiltration alerts