Entra admin password reset
An administrator reset another account's password, or re-enabled a disabled account, in Entra ID.
What it detects
An administrator reset another account's password, or re-enabled a disabled account, in Entra ID.
Both are ordinary help-desk actions and both are also how an attacker with directory rights takes over an existing identity instead of creating a new one — taking over an established account inherits its group memberships and licences and raises none of the alarms a new account does. Re-enabling a disabled account is the same move against an identity the organisation believed was retired.
MITRE ATT&CK mapping
- T1098Account Manipulation· Persistence
False positives and triage
This fires on normal help-desk work and is rated accordingly — it is context, not a verdict. Escalate when the target is privileged, when the actor is not a help-desk or identity administrator, when a long-disabled account is re-enabled, or when the reset is followed by a sign-in from an IP the account has never used.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 50%. Source: rules/cloud/entra_admin_password_reset.yaml, licensed under the Apache License 2.0.
id: cloud.identity.entra_admin_password_reset
version: 1.0.0
status: stable
severity: medium
confidence: 0.5
platforms: [application]
mitre_techniques: [T1098]
description: |
An administrator reset another account's password, or re-enabled a disabled
account, in Entra ID.
Both are ordinary help-desk actions and both are also how an attacker with
directory rights takes over an existing identity instead of creating a new one —
taking over an established account inherits its group memberships and licences and
raises none of the alarms a new account does. Re-enabling a disabled account is the
same move against an identity the organisation believed was retired.
match:
provider_any: [Office365, AzureAD]
event_action_contains_any:
- "Reset password (by admin)"
- "Reset user password"
- "Enable account"
correlation_keys: [target_user_name]
false_positive_guidance: |
This fires on normal help-desk work and is rated accordingly — it is context, not a
verdict. Escalate when the target is privileged, when the actor is not a help-desk
or identity administrator, when a long-disabled account is re-enabled, or when the
reset is followed by a sign-in from an IP the account has never used.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.