Rules Contributing to Microsoft Entra Changes to Privileged Account Alert

The following rules are used to identify suspicious Microsoft Entra changes to privileged account. Any one or more of these will trigger the Microsoft Entra Changes to Privileged Account Alert. Details for each rule can be viewed by clicking the More Details link in the description.

Title

Description

Password Reset by User Account

Detect when a user has reset their password in Microsoft Entra ID

Temporary Access Pass Added to an Account

Detects when a temporary access pass (TAP) is added to an account. TAPs added to privileged accounts should be investigated

Privileged Account Creation

Detects when a new admin is created.