entra-id

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Microsoft Entra ID — identity platform & detection

Microsoft Entra ID — 身份平台与检测

This skill encodes the identity-platform tribal knowledge for Microsoft Entra ID (formerly Azure AD) — the central identity provider for Microsoft 365, Azure, and thousands of SaaS applications. It covers the platform's architecture, telemetry surfaces, security features, and attack detection patterns.

Use this skill when working with:

Authentication telemetry — sign-in logs, audit logs, risk detections
Identity attacks — password spray, AiTM, MFA fatigue, token theft, OAuth abuse
Directory security — role assignments, Conditional Access, PIM, app registrations
Cross-tenant scenarios — B2B guest access, cross-tenant synchronisation, external identities
Workload identities — service principals, managed identities, federated credentials

Naming: "Azure AD" was renamed to "Microsoft Entra ID" in July 2023. The diagnostic log categories retain the legacy names (
SigninLogs
,
AADNonInteractiveUserSignInLogs
,
AuditLogs
). These names are used by Sentinel, but the same data is available in any SIEM via Event Hubs, Graph API, or diagnostic settings — field names and schemas are identical regardless of destination. This skill uses "Entra ID" for the product and the canonical log category names throughout.

本 skill 沉淀了 Microsoft Entra ID（原 Azure AD）的身份平台实战知识。它是 Microsoft 365、Azure 以及数千个 SaaS 应用的中心身份提供商，涵盖该平台的架构、遥测数据面、安全功能与攻击检测模式。

当处理以下工作时使用本 skill：

身份验证遥测 — 登录日志、审计日志、风险检测
身份攻击 — 密码喷洒（password spray）、AiTM、MFA 疲劳（MFA fatigue）、令牌窃取、OAuth 滥用
目录安全 — 角色分配、Conditional Access、PIM、应用注册
跨租户场景 — B2B 访客访问、跨租户同步、外部标识
工作负载身份 — 服务主体、托管标识、联合身份凭据

命名：“Azure AD”于 2023 年 7 月更名为“Microsoft Entra ID”。诊断日志类别仍保留旧名称（
SigninLogs
、
AADNonInteractiveUserSignInLogs
、
AuditLogs
）。Sentinel 使用这些名称，但通过 Event Hubs、Graph API 或诊断设置将同一数据摄取到任意 SIEM 时，也同样可以获得这些数据——无论目标平台是什么，字段名称和架构均相同。本 skill 在整个文档中使用“Entra ID”指代该产品，并始终使用规范的日志类别名称。

0. Entra ID architecture overview

0. Entra ID 架构概述

Entra ID is a multi-tenant, cloud-based identity and access management service. Every Microsoft 365 and Azure subscription has an Entra ID tenant. Key concepts:

Concept	Description
Tenant	A dedicated instance of Entra ID representing an organisation. Identified by a tenant ID (GUID) and one or more verified domains.
User principal	A human identity ( `user@domain.com` ). Can be a member or a guest (B2B).
Service principal	An application identity in a tenant. Created when an app registration is consented to or provisioned.
Managed identity	An Azure-managed service principal bound to an Azure resource (VM, Function, etc.). No credential management required.
App registration	The global definition of an application (multi-tenant). The service principal is the per-tenant instance.
Directory roles	Built-in or custom roles granting administrative permissions (Global Admin, Security Reader, etc.).
Conditional Access	Policy engine evaluating sign-in context (user, device, location, risk, app) to enforce access controls.
Identity Protection	Risk-based detection engine (P2) that scores sign-in risk and user risk.
PIM (Privileged Identity Management)	Just-in-time role activation for privileged roles (P2).

Entra ID 是一种多租户、云端身份与访问管理服务。每个 Microsoft 365 和 Azure 订阅都有一个 Entra ID 租户。关键概念：

概念	说明
租户（Tenant）	表示某个组织的专用 Entra ID 实例。通过租户 ID（GUID）以及一个或多个已验证域名进行标识。
用户主体（User principal）	表示人的身份（ `user@domain.com` ）。可以是成员或访客（B2B）。
服务主体（Service principal）	租户中的应用身份。在应用注册获得同意或完成预配时创建。
托管标识（Managed identity）	绑定到 Azure 资源（VM、Function 等）的 Azure 托管服务主体。无需管理凭据。
应用注册（App registration）	应用的全局定义（多租户）。服务主体则是各租户中的实例。
目录角色（Directory roles）	授予管理权限的内置或自定义角色（Global Admin、Security Reader 等）。
Conditional Access	根据登录上下文（用户、设备、位置、风险、应用）进行评估并实施访问控制的策略引擎。
Identity Protection	基于风险的检测引擎（P2），用于对登录风险和用户风险进行评分。
PIM（Privileged Identity Management）	为特权角色提供即时激活能力（P2）。

Entra ID log categories

Entra ID 日志类别

These are the canonical diagnostic log categories emitted by Entra ID. The names below are used in Sentinel, but the same schema and field names apply when ingested into Splunk (via Event Hubs / Azure Monitor Add-on), CrowdStrike NG-SIEM, Elastic, or any other SIEM.

Log category	What it captures	Licence	Ingestion path
`SigninLogs`	Interactive user sign-ins	Free (limited), P1, P2	Diagnostic settings, Graph API
`NonInteractiveUserSignInLogs`	Token refreshes, background app activity, SSO	P1, P2	Diagnostic settings
`ServicePrincipalSignInLogs`	Service principal (app) authentications	P1, P2	Diagnostic settings
`ManagedIdentitySignInLogs`	Managed identity authentications	P1, P2	Diagnostic settings
`AuditLogs`	Directory changes (user/group/role/app/policy CRUD)	Free, P1, P2	Diagnostic settings, Graph API
`RiskyUsers`	User risk state and history	P2	Graph API
`UserRiskEvents`	Individual risk detections	P2	Graph API
`RiskyServicePrincipals`	Workload identity risk	P2	Graph API
`ProvisioningLogs`	Cross-tenant sync, HR provisioning	P1, P2	Diagnostic settings
`NetworkAccessTrafficLogs`	Global Secure Access (Entra Internet/Private Access)	Separate licence	Diagnostic settings

SIEM mapping note: In Sentinel,
NonInteractiveUserSignInLogs
maps to the
AADNonInteractiveUserSignInLogs
table. In Splunk, the same data arrives via the
azure:aad:signin
sourcetype. In Elastic, it lands in
azure.signinlogs
. The field names within each record (e.g.,
ResultType
,
UserPrincipalName
,
IPAddress
) are consistent across all destinations because they originate from the same Entra ID diagnostic schema.

以下是 Entra ID 输出的规范诊断日志类别。下列名称在 Sentinel 中使用，但摄取到 Splunk（通过 Event Hubs / Azure Monitor Add-on）、CrowdStrike NG-SIEM、Elastic 或任何其他 SIEM 时，同一架构和字段名称同样适用。

日志类别	捕获内容	许可证	摄取路径
`SigninLogs`	交互式用户登录	免费版（受限）、P1、P2	诊断设置、Graph API
`NonInteractiveUserSignInLogs`	令牌刷新、后台应用活动、SSO	P1、P2	诊断设置
`ServicePrincipalSignInLogs`	服务主体（应用）身份验证	P1、P2	诊断设置
`ManagedIdentitySignInLogs`	托管标识身份验证	P1、P2	诊断设置
`AuditLogs`	目录变更（用户/组/角色/应用/策略 CRUD）	免费版、P1、P2	诊断设置、Graph API
`RiskyUsers`	用户风险状态及历史记录	P2	Graph API
`UserRiskEvents`	单项风险检测	P2	Graph API
`RiskyServicePrincipals`	工作负载身份风险	P2	Graph API
`ProvisioningLogs`	跨租户同步、HR 预配	P1、P2	诊断设置
`NetworkAccessTrafficLogs`	Global Secure Access（Entra Internet/Private Access）	单独的许可证	诊断设置

SIEM 映射说明：在 Sentinel 中，
NonInteractiveUserSignInLogs
映射到
AADNonInteractiveUserSignInLogs
表。在 Splunk 中，同一数据通过
azure:aad:signin
sourcetype 到达。在 Elastic 中，数据进入
azure.signinlogs
。每条记录中的字段名称（例如
ResultType
、
UserPrincipalName
、
IPAddress
）在所有目标平台中保持一致，因为它们都源自同一套 Entra ID 诊断架构。

1. SKU gating — what you can and cannot detect

1. SKU 限制——哪些内容可以检测、哪些不能

Identity Protection features are licence-dependent. Detection content must declare which tier it requires.

Feature	Entra ID P1	Entra ID P2	Free
`SigninLogs` table	Yes	Yes	Yes (limited)
`RiskLevelDuringSignIn` column	No	Yes	No
`RiskState` , `RiskDetail` columns	No	Yes	No
`RiskEventTypes_V2` column	No	Yes	No
`risky Users` / `riskDetections` APIs	No	Yes	No
Conditional Access policy evaluation logs	Yes	Yes	No
`AADNonInteractiveUserSignInLogs`	Yes	Yes	No
`ManagedIdentitySignInLogs`	Yes	Yes	No
`ServicePrincipalSignInLogs`	Yes	Yes	No

Gotcha: A detection that filters on

RiskLevelDuringSignIn == "high"

silently returns zero results in P1 tenants — the column exists but contains only

"none"

. In KQL, use

column_ifexists()

for P2-only columns. In SPL/other SIEMs, apply equivalent null-safe field access. Always declare the SKU tier requirement in detection content.

Identity Protection 功能取决于许可证。检测内容必须声明所需的 SKU 层级。

功能	Entra ID P1	Entra ID P2	免费版
`SigninLogs` 表	是	是	是（受限）
`RiskLevelDuringSignIn` 列	否	是	否
`RiskState` 、 `RiskDetail` 列	否	是	否
`RiskEventTypes_V2` 列	否	是	否
`risky Users` / `riskDetections` API	否	是	否
Conditional Access 策略评估日志	是	是	否
`AADNonInteractiveUserSignInLogs`	是	是	否
`ManagedIdentitySignInLogs`	是	是	否
`ServicePrincipalSignInLogs`	是	是	否

注意事项：过滤

RiskLevelDuringSignIn == "high"

的检测在 P1 租户中会静默返回零结果——该列虽然存在，但仅包含

"none"

。在 KQL 中，应对仅 P2 可用的列使用

column_ifexists()

。在 SPL 或其他 SIEM 中，应采用等效的空值安全字段访问方式。始终在检测内容中声明所需的 SKU 层级。

2. Sign-in risk vs user risk

2. 登录风险与用户风险

Two distinct risk models that are often confused:

Concept	Sign-in risk	User risk
Scope	Per-authentication event	Per-user entity (cumulative)
Column	`RiskLevelDuringSignIn`	`RiskLevelAggregated` (via `risky Users` API)
Triggers	Anomalous IP, impossible travel, AiTM proxy, malware-linked IP	Leaked credentials, confirmed compromise, cumulative sign-in risk
Remediation	MFA challenge, block	Password reset, block, confirm compromise
Detection use	Real-time alerting on suspicious sign-ins	Trend analysis, account compromise confirmation

Detection discipline: Use sign-in risk for real-time detection rules. Use user risk for enrichment and escalation logic, not as a primary detection signal (it lags).

这是两个不同的风险模型，经常被混淆：

概念	登录风险	用户风险
范围	每次身份验证事件	每用户实体（累积值）
列	`RiskLevelDuringSignIn`	`RiskLevelAggregated` （通过 `risky Users` API 获取）
触发因素	异常 IP、不可能的旅行、AiTM 代理、恶意软件关联 IP	泄露凭据、确认失陷、累积登录风险
缓解措施	MFA 质询、阻止	密码重置、阻止、确认失陷
检测用途	对可疑登录进行实时告警	趋势分析、确认账户失陷

检测原则：实时检测规则应使用登录风险。用户风险应用于信息富化和升级逻辑，而不应作为主要检测信号，因为它存在滞后。

3. ResultType code catalogue (critical subset)

3. ResultType 代码目录（关键子集）

ResultType

SigninLogs

is a string, not an integer. Always compare as string.

Code	Meaning	Detection relevance
`"0"`	Success	Baseline; combine with anomalous context
`"50126"`	Invalid credentials	Password spray, brute force
`"50053"`	Account locked	Brute force threshold reached
`"50057"`	Account disabled	Attempted use of disabled account
`"50074"`	MFA required (strong auth)	MFA challenge triggered
`"50076"`	MFA challenge failed	MFA bypass attempt
`"500121"`	MFA denied (user rejected)	MFA fatigue attack
`"50140"`	Keep Me Signed In (KMSI) interrupt	Session management
`"50158"`	External security challenge	Conditional Access external control
`"53003"`	Blocked by Conditional Access	Policy enforcement
`"530032"`	Blocked by security defaults	Baseline protection
`"700016"`	Application not found in tenant	Misconfigured or malicious app
`"7000218"`	Request body must contain client_assertion	Service principal auth issue
`"90094"`	Admin consent required	OAuth consent flow

Always comment ResultType codes inline — reviewers and analysts cannot memorise them.

SigninLogs

中的

ResultType

是字符串，而不是整数。始终按字符串进行比较。

代码	含义	与检测的关系
`"0"`	成功	基线；需结合异常上下文判断
`"50126"`	凭据无效	密码喷洒、暴力破解
`"50053"`	账户已锁定	已达到暴力破解阈值
`"50057"`	账户已禁用	尝试使用已禁用账户
`"50074"`	需要 MFA（强身份验证）	已触发 MFA 质询
`"50076"`	MFA 质询失败	MFA 绕过尝试
`"500121"`	MFA 被拒绝（用户拒绝）	MFA 疲劳攻击
`"50140"`	Keep Me Signed In（KMSI）中断	会话管理
`"50158"`	外部安全质询	Conditional Access 外部控制
`"53003"`	被 Conditional Access 阻止	策略执行
`"530032"`	被安全默认值阻止	基线保护
`"700016"`	租户中找不到应用	配置错误或恶意应用
`"7000218"`	请求正文必须包含 client_assertion	服务主体身份验证问题
`"90094"`	需要管理员同意	OAuth 同意流程

始终在代码中内联注释 ResultType 代码——评审人员和分析人员无法记住所有代码的含义。

4. Detection-relevant platform behaviours

4. 与检测相关的平台行为

The signals below describe what Entra ID emits when specific identity-layer activity occurs. They are not attack descriptions — pair with threat vector objects (TVMs) for adversary context.

以下信号描述了特定身份层活动发生时，Entra ID 会输出什么。它们并非攻击描述——应结合威胁向量对象（TVM）来提供攻击者上下文。

4.1 Credential failure patterns

4.1 凭据失败模式

Signal	Log category	Key fields
High failure rate per IP	`SigninLogs`	`IPAddress` , `ResultType` ( `"50126"` , `"50053"` , `"50064"` ), `UserPrincipalName`
Many distinct users per IP	`SigninLogs`	`UserPrincipalName` (distinct count), `IPAddress`
Account lockout triggered	`SigninLogs`	`ResultType == "50053"`
Disabled account access attempt	`SigninLogs`	`ResultType == "50057"`

信号	日志类别	关键字段
单个 IP 的失败率很高	`SigninLogs`	`IPAddress` 、 `ResultType` （ `"50126"` 、 `"50053"` 、 `"50064"` ）、 `UserPrincipalName`
单个 IP 对应大量不同用户	`SigninLogs`	`UserPrincipalName` （不同值计数）、 `IPAddress`
触发账户锁定	`SigninLogs`	`ResultType == "50053"`
尝试访问已禁用账户	`SigninLogs`	`ResultType == "50057"`

4.2 MFA challenge signals

4.2 MFA 质询信号

Signal	Log category	Key fields
MFA denial burst	`SigninLogs`	`ResultType == "500121"` , `UserPrincipalName`
MFA success after denials	`SigninLogs`	`ResultType == "0"` following `"500121"` for same user
MFA call limit reached	`SigninLogs`	`ResultType == "50088"`
Risky MFA enrolment blocked	`SigninLogs`	`ResultType == "53004"`

信号	日志类别	关键字段
MFA 拒绝集中爆发	`SigninLogs`	`ResultType == "500121"` 、 `UserPrincipalName`
多次拒绝后 MFA 成功	`SigninLogs`	同一用户的 `"500121"` 之后出现 `ResultType == "0"`
达到 MFA 呼叫次数上限	`SigninLogs`	`ResultType == "50088"`
高风险 MFA 注册被阻止	`SigninLogs`	`ResultType == "53004"`

4.3 Token and session anomalies

4.3 令牌与会话异常

Signal	Log category	Key fields
Sign-in with elevated risk	`SigninLogs`	`RiskLevelDuringSignIn` (P2 only)
Token replay indicator	`SigninLogs`	`CorrelationId` , `TokenIssuerType` , `IPAddress` mismatch
Non-interactive sign-in from new device	`NonInteractiveUserSignInLogs`	`DeviceDetail` , `IPAddress`
PRT usage indicator	`SigninLogs`	`AuthenticationProcessingDetails` contains `"Is Primary Refresh Token"`

信号	日志类别	关键字段
以较高风险登录	`SigninLogs`	`RiskLevelDuringSignIn` （仅 P2）
令牌重放指标	`SigninLogs`	`CorrelationId` 、 `TokenIssuerType` 、 `IPAddress` 不匹配
从新设备进行非交互式登录	`NonInteractiveUserSignInLogs`	`DeviceDetail` 、 `IPAddress`
PRT 使用指标	`SigninLogs`	`AuthenticationProcessingDetails` 包含 `"Is Primary Refresh Token"`

4.4 Consent and application changes

4.4 同意授权与应用变更

Signal	Log category	Key fields
New consent grant	`AuditLogs`	`OperationName == "Consent to application"`
High-privilege permission granted	`AuditLogs`	`TargetResources[0].modifiedProperties`
New credential added to app/SP	`AuditLogs`	`OperationName in ("Add service principal credentials", "Update application – Certificates and secrets management")`
Federated credential added	`AuditLogs`	`OperationName has "federatedIdentityCredential"`

信号	日志类别	关键字段
新的同意授权	`AuditLogs`	`OperationName == "Consent to application"`
授予高权限	`AuditLogs`	`TargetResources[0].modifiedProperties`
向应用/SP 添加新凭据	`AuditLogs`	`OperationName in ("Add service principal credentials", "Update application – Certificates and secrets management")`
添加联合身份凭据	`AuditLogs`	`OperationName has "federatedIdentityCredential"`

4.5 Directory and policy changes

4.5 目录与策略变更

Signal	Log category	Key fields
Conditional Access policy modified	`AuditLogs`	`OperationName has "conditional access"` , `TargetResources`
Permanent role assignment	`AuditLogs`	`OperationName == "Add member to role"`
PIM role activation	`AuditLogs`	`OperationName == "Add member to role completed (PIM activation)"`
Service principal sign-in from new IP	`ServicePrincipalSignInLogs`	`ServicePrincipalId` , `IPAddress`

信号	日志类别	关键字段
Conditional Access 策略被修改	`AuditLogs`	`OperationName has "conditional access"` 、 `TargetResources`
永久角色分配	`AuditLogs`	`OperationName == "Add member to role"`
PIM 角色激活	`AuditLogs`	`OperationName == "Add member to role completed (PIM activation)"`
服务主体从新 IP 登录	`ServicePrincipalSignInLogs`	`ServicePrincipalId` 、 `IPAddress`

5. Telemetry split — user vs service principal vs managed identity

5. 遥测拆分——用户、服务主体与托管标识

Principal type	Sign-in log category	Audit log category
Interactive user	`SigninLogs`	`AuditLogs`
Non-interactive user	`NonInteractiveUserSignInLogs`	`AuditLogs`
Service principal	`ServicePrincipalSignInLogs`	`AuditLogs`
Managed identity	`ManagedIdentitySignInLogs`	`AuditLogs`

Common mistake: Querying only interactive sign-ins and missing non-interactive activity. Token refresh, background app activity, and service-to-service calls appear in the non-interactive and service principal log categories.

For comprehensive identity coverage, query across all relevant sign-in categories. Example (KQL — adapt to your SIEM's query language):

kql

// Sentinel / KQL example — adapt for Splunk, Elastic, etc.
union isfuzzy=true SigninLogs, AADNonInteractiveUserSignInLogs
| where TimeGenerated > ago(14d)
| where ResultType == "0"
// ... detection logic

主体类型	登录日志类别	审计日志类别
交互式用户	`SigninLogs`	`AuditLogs`
非交互式用户	`NonInteractiveUserSignInLogs`	`AuditLogs`
服务主体	`ServicePrincipalSignInLogs`	`AuditLogs`
托管标识	`ManagedIdentitySignInLogs`	`AuditLogs`

常见错误：只查询交互式登录，遗漏非交互式活动。令牌刷新、后台应用活动和服务间调用会出现在非交互式及服务主体日志类别中。

若要全面覆盖身份活动，应查询所有相关的登录类别。示例（KQL——请根据你的 SIEM 查询语言进行调整）：

kql

// Sentinel / KQL example — adapt for Splunk, Elastic, etc.
union isfuzzy=true SigninLogs, AADNonInteractiveUserSignInLogs
| where TimeGenerated > ago(14d)
| where ResultType == "0"
// ... detection logic

6. Cross-tenant and B2B considerations

6. 跨租户与 B2B 注意事项

Scenario	Column	Value
Home tenant sign-in	`HomeTenantId == ResourceTenantId`	Normal
Guest user (B2B)	`HomeTenantId != ResourceTenantId`	Cross-tenant access
External identity provider	`TokenIssuerType`	`"External"`

Detection discipline: B2B guest access is legitimate but high-risk. Detections should distinguish between established B2B relationships and novel cross-tenant access.

场景	列	值
主租户登录	`HomeTenantId == ResourceTenantId`	正常
访客用户（B2B）	`HomeTenantId != ResourceTenantId`	跨租户访问
外部身份提供商	`TokenIssuerType`	`"External"`

检测原则：B2B 访客访问本身是合法行为，但具有较高风险。检测应区分已建立的 B2B 关系与新出现的跨租户访问。

7. Nested JSON field paths

7. 嵌套 JSON 字段路径

Many sign-in and audit log fields contain nested JSON objects. The field paths below are consistent across all SIEMs — only the extraction syntax differs (KQL

parse_json()

, SPL

spath

, Elastic nested field access, etc.).

许多登录和审计日志字段都包含嵌套 JSON 对象。以下字段路径在所有 SIEM 中均一致——差异仅在于提取语法（KQL

parse_json()

、SPL

spath

、Elastic 嵌套字段访问等）。

SigninLogs nested fields

SigninLogs 嵌套字段

Top-level field	Nested path	Type	Use
`LocationDetails`	`.city`	string	Geo-anomaly detection
`LocationDetails`	`.countryOrRegion`	string	Impossible travel
`LocationDetails`	`.state`	string	Regional baselining
`DeviceDetail`	`.browser`	string	User agent anomaly
`DeviceDetail`	`.operatingSystem`	string	Platform baselining
`DeviceDetail`	`.isCompliant`	bool	Device compliance check
`DeviceDetail`	`.deviceId`	string	Device identity correlation
`ConditionalAccessPolicies`	`[].displayName`	string (array)	Which CA policies evaluated
`ConditionalAccessPolicies`	`[].result`	string (array)	`"success"` , `"failure"` , `"notApplied"`
`AuthenticationDetails`	`[].authenticationMethod`	string (array)	MFA method used
`AuthenticationDetails`	`[].succeeded`	bool (array)	Per-step auth result
`AuthenticationProcessingDetails`	`[].key`	string (array)	Contains `"Is Primary Refresh Token"` for PRT usage

顶层字段	嵌套路径	类型	用途
`LocationDetails`	`.city`	string	地理异常检测
`LocationDetails`	`.countryOrRegion`	string	不可能的旅行
`LocationDetails`	`.state`	string	区域基线
`DeviceDetail`	`.browser`	string	用户代理异常
`DeviceDetail`	`.operatingSystem`	string	平台基线
`DeviceDetail`	`.isCompliant`	bool	设备合规性检查
`DeviceDetail`	`.deviceId`	string	设备身份关联
`ConditionalAccessPolicies`	`[].displayName`	string（数组）	已评估的 CA 策略
`ConditionalAccessPolicies`	`[].result`	string（数组）	`"success"` 、 `"failure"` 、 `"notApplied"`
`AuthenticationDetails`	`[].authenticationMethod`	string（数组）	使用的 MFA 方法
`AuthenticationDetails`	`[].succeeded`	bool（数组）	每一步身份验证结果
`AuthenticationProcessingDetails`	`[].key`	string（数组）	包含 `"Is Primary Refresh Token"` 表示 PRT 使用情况

AuditLogs nested fields

AuditLogs 嵌套字段

Top-level field	Nested path	Type	Use
`InitiatedBy`	`.user.userPrincipalName`	string	Who performed the action
`InitiatedBy`	`.app.displayName`	string	App-initiated changes
`TargetResources`	`[0].displayName`	string	Target object name
`TargetResources`	`[0].userPrincipalName`	string	Target user
`TargetResources`	`[0].modifiedProperties`	array	What changed (old/new values)

顶层字段	嵌套路径	类型	用途
`InitiatedBy`	`.user.userPrincipalName`	string	执行操作的用户
`InitiatedBy`	`.app.displayName`	string	由应用发起的变更
`TargetResources`	`[0].displayName`	string	目标对象名称
`TargetResources`	`[0].userPrincipalName`	string	目标用户
`TargetResources`	`[0].modifiedProperties`	array	变更内容（旧值/新值）

8. Directory role and PIM monitoring

8. 目录角色与 PIM 监控

Critical directory roles

关键目录角色

Role	Risk	Why
Global Administrator	Critical	Full tenant control — can reset any password, modify any policy
Privileged Role Administrator	Critical	Can assign any role including Global Admin
Application Administrator	High	Can create/modify app registrations and consent to permissions
Cloud Application Administrator	High	Same as above minus on-prem app proxy
Exchange Administrator	High	Mailbox access, mail flow rules — BEC enabler
Security Administrator	High	Can modify security policies, read all security data
Conditional Access Administrator	High	Can weaken or disable CA policies
Partner Tier2 Support	Critical	Delegated admin — supply-chain attack vector

角色	风险	原因
Global Administrator	严重	完全控制租户——可重置任意密码、修改任意策略
Privileged Role Administrator	严重	可分配任意角色，包括 Global Admin
Application Administrator	高	可创建或修改应用注册并同意权限
Cloud Application Administrator	高	与上项类似，但不包含本地应用代理
Exchange Administrator	高	可访问邮箱、配置邮件流规则——可促成 BEC
Security Administrator	高	可修改安全策略、读取所有安全数据
Conditional Access Administrator	高	可削弱或禁用 CA 策略
Partner Tier2 Support	严重	委派管理员——供应链攻击向量

Key AuditLogs operations for role monitoring

用于角色监控的关键 AuditLogs 操作

Operation	`OperationName` value	What it means
PIM activation	`"Add member to role completed (PIM activation)"`	Just-in-time role elevation
Permanent assignment	`"Add member to role"`	Bypasses PIM — persistence risk
Role removal	`"Remove member from role"`	Privilege revocation or cleanup
Eligible assignment	`"Add eligible member to role in PIM"`	PIM-eligible (not yet active)

For example queries, see references/Detection-Cheatsheet.md.

操作	`OperationName` 值	含义
PIM 激活	`"Add member to role completed (PIM activation)"`	即时提升角色权限
永久分配	`"Add member to role"`	绕过 PIM——存在持久化风险
移除角色	`"Remove member from role"`	权限撤销或清理
符合条件的分配	`"Add eligible member to role in PIM"`	符合 PIM 条件，但尚未激活

有关示例查询，请参阅 references/Detection-Cheatsheet.md。

9. Token and session mechanics

9. 令牌与会话机制

Understanding token types is critical for detecting token theft and replay:

Token	Lifetime	Storage	Theft vector
Access token	60–90 min (configurable)	Memory	Process memory dump, AiTM proxy
Refresh token	90 days (sliding)	Disk/browser	Malware, AiTM, device compromise
Primary Refresh Token (PRT)	14 days	TPM-bound (ideally)	`mimikatz` , `ROADtools` , device compromise
Session cookie	Varies	Browser	Cookie theft, AiTM proxy
FOCI token	Varies	Shared across FOCI apps	One compromised FOCI app exposes others

理解令牌类型对于检测令牌窃取与重放至关重要：

令牌	生存期	存储位置	窃取向量
Access token	60–90 分钟（可配置）	内存	进程内存转储、AiTM 代理
Refresh token	90 天（滑动）	磁盘/浏览器	恶意软件、AiTM、设备失陷
Primary Refresh Token（PRT）	14 天	理想情况下绑定 TPM	`mimikatz` 、 `ROADtools` 、设备失陷
Session cookie	不定	浏览器	Cookie 窃取、AiTM 代理
FOCI token	不定	在 FOCI 应用之间共享	一个 FOCI 应用失陷会波及其他应用

FOCI (Family of Client IDs)

FOCI（Family of Client IDs）

Microsoft first-party apps share refresh tokens via FOCI. If an attacker steals a refresh token for one FOCI app (e.g., Outlook), they can exchange it for tokens to other FOCI apps (e.g., Teams, OneDrive) without re-authenticating. Key FOCI client IDs:

App	Client ID
Microsoft Office	`d3590ed6-52b3-4102-aeff-aad2292ab01c`
Microsoft Teams	`1fec8e78-bce4-4aaf-ab1b-5451cc387264`
Outlook Mobile	`27922004-5251-4030-b22d-91ecd9a37ea4`
OneDrive	`ab9b8c07-8f02-4f72-87fa-80105867a763`

Microsoft 第一方应用通过 FOCI 共享刷新令牌。如果攻击者窃取了某个 FOCI 应用（例如 Outlook）的刷新令牌，就可以在无需重新进行身份验证的情况下，将其兑换为其他 FOCI 应用（例如 Teams、OneDrive）的令牌。关键 FOCI 客户端 ID：

应用	客户端 ID
Microsoft Office	`d3590ed6-52b3-4102-aeff-aad2292ab01c`
Microsoft Teams	`1fec8e78-bce4-4aaf-ab1b-5451cc387264`
Outlook Mobile	`27922004-5251-4030-b22d-91ecd9a37ea4`
OneDrive	`ab9b8c07-8f02-4f72-87fa-80105867a763`

Token theft detection signals

令牌窃取检测信号

Signal	Log category	Key fields
Access token replay from new IP	`SigninLogs`	Same `CorrelationId` , different `IPAddress`
Refresh token from anomalous device	`NonInteractiveUserSignInLogs`	`DeviceDetail` mismatch
PRT usage (pass-the-PRT)	`SigninLogs`	`AuthenticationProcessingDetails` contains `"Is Primary Refresh Token"`
Impossible travel on token refresh	`NonInteractiveUserSignInLogs`	Geo-distance between consecutive sign-ins

信号	日志类别	关键字段
从新 IP 重放 Access token	`SigninLogs`	相同的 `CorrelationId` 、不同的 `IPAddress`
从异常设备刷新 Refresh token	`NonInteractiveUserSignInLogs`	`DeviceDetail` 不匹配
PRT 使用（pass-the-PRT）	`SigninLogs`	`AuthenticationProcessingDetails` 包含 `"Is Primary Refresh Token"`
令牌刷新期间出现不可能的旅行	`NonInteractiveUserSignInLogs`	连续登录之间的地理距离

10. Application and consent landscape

10. 应用与同意授权全景

App registration vs service principal

应用注册与服务主体

Concept	Scope	Created by
App registration	Global (multi-tenant) or single-tenant	Developer
Service principal	Per-tenant instance	Auto-created on consent or provisioning
Enterprise application	UI name for service principal	—

概念	范围	创建方式
应用注册（App registration）	全局（多租户）或单租户	开发者
服务主体（Service principal）	各租户中的实例	获得同意或完成预配后自动创建
企业应用（Enterprise application）	服务主体在 UI 中的名称	—

Dangerous permissions to monitor

需要监控的危险权限

Permission	Type	Risk
`Mail.ReadWrite`	Application	Read/write all mailboxes — BEC
`Files.ReadWrite.All`	Application	Read/write all OneDrive/SharePoint — exfiltration
`Directory.ReadWrite.All`	Application	Full directory modification — persistence
`RoleManagement.ReadWrite.Directory`	Application	Assign any directory role — privilege escalation
`AppRoleAssignment.ReadWrite.All`	Application	Grant any app permission — self-escalation
`User.ReadWrite.All`	Application	Modify any user — password reset, MFA bypass

权限	类型	风险
`Mail.ReadWrite`	Application	读取/写入所有邮箱——BEC
`Files.ReadWrite.All`	Application	读取/写入所有 OneDrive/SharePoint——数据外泄
`Directory.ReadWrite.All`	Application	修改整个目录——持久化
`RoleManagement.ReadWrite.Directory`	Application	分配任意目录角色——权限提升
`AppRoleAssignment.ReadWrite.All`	Application	授予任意应用权限——自我提权
`User.ReadWrite.All`	Application	修改任意用户——密码重置、MFA 绕过

Key AuditLogs operations for consent monitoring

用于同意授权监控的关键 AuditLogs 操作

Operation	`OperationName` value	What it means
User/admin consent	`"Consent to application"`	Permission grant — check `TargetResources[0].modifiedProperties` for scope
App role assignment	`"Add app role assignment to service principal"`	Application permission granted
OAuth2 permission grant	`"Add OAuth2PermissionGrant"`	Delegated permission granted

For example queries, see references/Detection-Cheatsheet.md.

操作	`OperationName` 值	含义
用户/管理员同意	`"Consent to application"`	权限授予——检查 `TargetResources[0].modifiedProperties` 中的 scope
应用角色分配	`"Add app role assignment to service principal"`	已授予 Application 权限
OAuth2 权限授予	`"Add OAuth2PermissionGrant"`	已授予 Delegated 权限

有关示例查询，请参阅 references/Detection-Cheatsheet.md。

11. Entity identifier alignment

11. 实体标识对齐

Concept	Entra ID / Sentinel	Defender	CrowdStrike
User	`UserPrincipalName` , `UserId` (GUID)	`AccountUpn` , `AccountSid`	`UserName`
Device	`DeviceDetail.deviceId`	`DeviceId`	`aid`
IP	`IPAddress`	`RemoteIP`	`RemoteAddressIP4`
Application	`AppId` , `AppDisplayName`	—	—
Service principal	`ServicePrincipalId`	—	—

Cross-platform correlation happens at the SIEM/SOAR layer. The

UserPrincipalName

is the most reliable cross-platform join key for identity.

概念	Entra ID / Sentinel	Defender	CrowdStrike
用户	`UserPrincipalName` 、 `UserId` （GUID）	`AccountUpn` 、 `AccountSid`	`UserName`
设备	`DeviceDetail.deviceId`	`DeviceId`	`aid`
IP	`IPAddress`	`RemoteIP`	`RemoteAddressIP4`
应用	`AppId` 、 `AppDisplayName`	—	—
服务主体	`ServicePrincipalId`	—	—

跨平台关联发生在 SIEM/SOAR 层。

UserPrincipalName

是进行身份关联最可靠的跨平台联接键。

12. Detection cheatsheet

12. 检测速查表

For example KQL queries covering password spray, MFA fatigue, AiTM chains, OAuth consent, SP credential addition, cross-tenant anomalies, and PIM activations, see references/Detection-Cheatsheet.md. The logic and field names are portable — adapt the syntax to your SIEM.

有关密码喷洒、MFA 疲劳、AiTM 攻击链、OAuth 同意授权、SP 凭据添加、跨租户异常和 PIM 激活的示例 KQL 查询，请参阅 references/Detection-Cheatsheet.md。这些逻辑和字段名称具有可移植性——请根据你的 SIEM 调整语法。

13. Quality checklist

13. 质量检查清单

SKU tier requirement declared (P1 vs P2).
```
column_ifexists()
```
used for P2-only columns.
```
ResultType
```
compared as string, not integer.
ResultType codes commented inline with meaning.
All relevant sign-in tables queried (interactive + non-interactive + SP where applicable).
Nested JSON parsed via
```
parse_json()
```
/
```
todynamic()
```
.
Cross-tenant scenarios considered (B2B guest access).
Risk columns used for enrichment, not as sole detection signal in P1 environments.
Directory role changes monitored (permanent assignments, PIM activations).
Token type and theft vector documented for token-based detections.
Dangerous application permissions flagged in consent-based detections.
FOCI token sharing considered for token theft scope assessment.
MITRE technique mapping accurate (T1078, T1098, T1556, T1621, T1557 as applicable).
Coordinate with the relevant platform skill for query mechanics (
```
microsoft-sentinel
```
,
```
splunk-spl-processing
```
,
```
crowdstrike-falcon
```
, etc.) and
```
detection-engineering
```
for lifecycle.

已声明 SKU 层级要求（P1 与 P2）。
对仅 P2 可用的列使用了
```
column_ifexists()
```
。
```
ResultType
```
按字符串而非整数进行比较。
已内联注释 ResultType 代码及其含义。
查询了所有相关登录表（交互式 + 非交互式 + 适用时的 SP）。
通过
```
parse_json()
```
/
```
todynamic()
```
解析嵌套 JSON。
已考虑跨租户场景（B2B 访客访问）。
风险列用于信息富化，而不是在 P1 环境中作为唯一检测信号。
已监控目录角色变更（永久分配、PIM 激活）。
已为基于令牌的检测记录令牌类型和窃取向量。
已在基于同意授权的检测中标记危险的应用权限。
已考虑 FOCI 令牌共享，以评估令牌窃取的影响范围。
MITRE 技术映射准确（T1078、T1098、T1556、T1621、T1557 等）。
与相关平台 skill 协作处理查询机制（
```
microsoft-sentinel
```
、
```
splunk-spl-processing
```
、
```
crowdstrike-falcon
```
等），并与
```
detection-engineering
```
协作处理生命周期。