Guest accounts added in Entra ID Groups other than the ones specified
Guest Accounts are added in the Organization Tenants to perform various tasks i.e projects execution, support etc.. This detection notifies when guest users are added to Microsoft Entra ID Groups other than the ones…
Description
Guest Accounts are added in the Organization Tenants to perform various tasks i.e projects execution, support etc.. This detection notifies when guest users are added to Microsoft Entra ID Groups other than the ones specified and poses a risk to gain access to sensitive apps or data.
Detection logic
Detection requirements
- Platform
- IaaSIdentity ProviderOffice SuiteSaaS
The rule states no platform. This is derived from the 3 ATT&CK techniques it maps to.
- Log source product
- azureactivedirectory
- Log source service
- auditlogs
MITRE ATT&CK mappings
0 exclusive techniques.This is coverage no other published rule has; it is not this rule's total technique count.
No references are available for this detection.
From the source
- At source
- Open at source
- Upstream identifier
- 6ab1f7b2-61b8-442f-bc81-96afe7ad8c53
- Tagged by the source as
- DiscoveryInitialAccessPersistence
Licence
- Published under
- MIT LicenseRead the licence
- Attribution
- Required
- Obtained under
- MITRead the origin licence
Authorship
- Published
- Sep 1, 2026
- Version
- 1