Azure AD – Identity Protection has been extended to also covers workload identities (preview)

Detection type

Detection type

Description

Azure AD threat intelligence

Offline

This risk detection indicates some activity that is consistent with known attack patterns based on Microsoft’s internal and external threat intelligence sources.

Suspicious Sign-ins

Offline

This risk detection indicates sign-in properties or patterns that are unusual for this service principal.
The detection learns the baselines sign-in behavior for workload identities in your tenant in between 2 and 60 days, and fires if one or more of the following unfamiliar properties appear during a later sign-in: IP address / ASN, target resource, user agent, hosting/non-hosting IP change, IP country, credential type.
Because of the programmatic nature of workload identity sign-ins, we provide a timestamp for the suspicious activity instead of flagging a specific sign-in event.
Sign-ins that are initiated after an authorized configuration change may trigger this detection.

Unusual addition of credentials to an OAuth app

Offline

This detection is discovered by Microsoft Defender for Cloud Apps. This detection identifies the suspicious addition of privileged credentials to an OAuth app. This can indicate that an attacker has compromised the app, and is using it for malicious activity.

Admin confirmed account compromised

Offline

This detection indicates an admin has selected ‘Confirm compromised’ in the Risky Workload Identities UI or using riskyServicePrincipals API. To see which admin has confirmed this account compromised, check the account’s risk history (via UI or API).