Microsoft 365 domain federation change
A tenant domain's authentication or federation settings were changed, or a new domain was added (Set domain authentication / Set federation settings /…
What it detects
A tenant domain's authentication or federation settings were changed, or a new domain was added (Set domain authentication / Set federation settings / Add domain). Modifying federation lets an attacker forge tokens for ANY user in the tenant (a "Golden SAML" attack) — one of the most severe cloud persistence and privilege-escalation moves there is. Legitimate changes are rare and planned.
MITRE ATT&CK mapping
False positives and triage
Domain/federation changes happen during real migrations and identity projects, but they are infrequent and change-controlled. ANY such change outside a known window — especially adding a federated domain or altering domain auth — should be treated as a probable tenant compromise until proven otherwise.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 75%. Source: rules/cloud/m365_domain_federation_change.yaml, licensed under the Apache License 2.0.
id: cloud.identity.m365_domain_federation_change
version: 1.2.0
status: stable
severity: critical
confidence: 0.75
platforms: [application]
mitre_techniques: [T1484.002, T1556]
description: |
A tenant domain's authentication or federation settings were changed, or a new
domain was added (Set domain authentication / Set federation settings / Add
domain). Modifying federation lets an attacker forge tokens for ANY user in the
tenant (a "Golden SAML" attack) — one of the most severe cloud persistence and
privilege-escalation moves there is. Legitimate changes are rare and planned.
match:
provider_any: [Office365, AzureAD]
event_action_contains_any:
- "Set domain authentication"
# The Exchange cmdlet spelling of the same tenant change. Federation can be added
# through Exchange as well as through the directory, and only the directory
# spellings were listed — so an `Add-FederatedDomain` was invisible.
- "Add-FederatedDomain"
- "New-AcceptedDomain"
- "Set federation settings on domain"
- "Set-MsolDomainFederationSettings"
# Domain object changes short of federation: a new subdomain registered under
# the tenant is enough to mint convincing phishing links and valid certs.
- "Set-MsolDomain"
- "Add-Domain"
- "Add unverified domain"
- "Add domain to company"
- "Update domain"
- "Add partner to company"
correlation_keys: [user_name]
false_positive_guidance: |
Domain/federation changes happen during real migrations and identity projects,
but they are infrequent and change-controlled. ANY such change outside a known
window — especially adding a federated domain or altering domain auth — should be
treated as a probable tenant compromise until proven otherwise.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.