Entra strong auth disabled
Multi-factor authentication was turned off for an Entra ID account ("Disable Strong Authentication"), or the per-user MFA requirement was cleared.
What it detects
Multi-factor authentication was turned off for an Entra ID account ("Disable Strong Authentication"), or the per-user MFA requirement was cleared.
Removing MFA is how an attacker converts a stolen password into repeatable access. It is normally one of the last steps of an account takeover rather than the first, so it is worth reading alongside what the same account did immediately before.
MITRE ATT&CK mapping
- T1556.006Modify Authentication Process: Multi-Factor Authentication· Persistence
False positives and triage
Help desks disable MFA legitimately when a user loses a device, and tenants migrating from per-user MFA to Conditional Access disable it in bulk — a burst during a known migration is expected. The signal is a disable for a single account with no matching ticket, performed by an account that does not normally administer identity, or followed by a sign-in from a new IP.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 70%. Source: rules/cloud/entra_strong_auth_disabled.yaml, licensed under the Apache License 2.0.
id: cloud.identity.entra_strong_auth_disabled
version: 1.0.0
status: stable
severity: high
confidence: 0.7
platforms: [application]
mitre_techniques: [T1556.006]
description: |
Multi-factor authentication was turned off for an Entra ID account
("Disable Strong Authentication"), or the per-user MFA requirement was cleared.
Removing MFA is how an attacker converts a stolen password into repeatable access.
It is normally one of the last steps of an account takeover rather than the first,
so it is worth reading alongside what the same account did immediately before.
match:
provider_any: [Office365, AzureAD]
event_action_contains_any:
- "Disable Strong Authentication"
- "Disable account MFA"
correlation_keys: [target_user_name]
false_positive_guidance: |
Help desks disable MFA legitimately when a user loses a device, and tenants
migrating from per-user MFA to Conditional Access disable it in bulk — a burst
during a known migration is expected. The signal is a disable for a single account
with no matching ticket, performed by an account that does not normally administer
identity, or followed by a sign-in from a new IP.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.