Authentication Method Changed for an User
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Flags modifications to user authentication methods like registered devices, phone numbers, or FIDO credentials
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "DETECTION_ACTION_M365_AUTH_METHOD_CHANGED_FOR_USER" select Action1.CALLER,Action1.TARGET,Action1.RESULT,Action1.MODIFIED_PROPERTIES_GD,Action1.STATUS_OF_OPERATION,Action1.TARGET_ID,Action1.OPERATION
Detection
Execution Mode
realtime
Log Sources
Microsoft 365
