Unexpected Microsoft Entra activity indicating administrative unit modification
Description
AlphaSOC detected a Microsoft Entra ID administrative unit (AU) being updated, restored, deleted, or permanently deleted, with an unexpected action, source ASN, or user agent. Administrative units define the scope within which delegated administrators can manage users, groups, and devices. Unexpected changes may indicate an attacker altering delegated administration.
Impact
Unauthorized changes to an AU can disrupt delegated administration or alter how selected accounts and resources are managed. Depending on the change and associated role assignments, attackers may undermine access controls or interfere with legitimate administrators' ability to manage affected members. Deleting a restricted management AU removes the protection it provides to all its members, potentially enabling tenant-level administrators to reset user passwords or modify protected groups and devices.
Severity
Unexpected properties include the action, source ASN, and user agent.
| Severity | Condition |
|---|---|
Informational | Administrative unit modified with one unexpected property |
Low | Administrative unit modified with two unexpected properties |
Medium | Administrative unit modified with three unexpected properties |
Investigation and Remediation
Review Entra audit logs for Update administrative unit,
Restore administrative unit, Delete administrative unit, and
Hard delete administrative unit events. Identify the acting identity and
affected AU. Compare its properties, membership, and scoped role assignments
with the approved configuration and verify that the change was authorized.
If unauthorized, restore the approved configuration where possible and remove any malicious role assignments. Investigate the acting identity and review related account or membership changes for signs of compromise.