UnknownMicrosoft Sentinel analytics
Dataverse - Generic client app used to access production environments
This query detects the use of the built-in "Dynamics 365 Example Application" to access production environments. This generic app can not be restricted by Azure AD authorization controls and could be abused to gain…
Description
This query detects the use of the built-in "Dynamics 365 Example Application" to access production environments. This generic app can not be restricted by Azure AD authorization controls and could be abused to gain unauthorized access via Web API.
Detection logic
Detection requirements
- Platform
- LinuxmacOSNoneWindows
The rule states no platform. This is derived from the 2 ATT&CK techniques it maps to.
- Log source product
- azureactivedirectorydataverse
- Log source service
- dataverseactivitysigninlogs
MITRE ATT&CK mappings
0 exclusive techniques.This is coverage no other published rule has; it is not this rule's total technique count.
Outside the enterprise matrix
No references are available for this detection.
From the source
- At source
- Open at source
- Upstream identifier
- 90bcbd4e-e8b5-4a5d-9fe6-d0f9f0220b4a
- Tagged by the source as
- Execution
Licence
- Published under
- MIT LicenseRead the licence
- Attribution
- Required
- Obtained under
- MITRead the origin licence
Authorship
- Published
- Sep 1, 2026
- Version
- 1