Successful Signin From Non-Compliant Device

Detects successful sign ins from devices marked non-compliant. Best practice is to block sign ins from non-complaint devices, however if allowed monitor these events to ensure they do not lead to other risky activity.

Detection logic

Detection requirements

Platform: IaaS Identity Provider Office Suite SaaS
The rule states no platform. This is derived from the ATT&CK technique it maps to.
Log source product: azureactivedirectory behavioranalytics
Log source service: behavioranalytics identityinfo signinlogs

Detection rules

Successful Signin From Non-Compliant Device

Detection logic

Detection requirements

MITRE ATT&CK mappings

From the source

Licence

Authorship

Detection rules