---
title: Entra ID device registration burst by single user
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Entra ID device registration burst by
  single user
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Entra ID device registration burst by single user
Classification:attackTactic:[TA0003-persistence](https://attack.mitre.org/tactics/TA0003)Technique:[T1098-account-manipulation](https://attack.mitre.org/techniques/T1098) 
## Goal{% #goal %}

Detects a burst of successful Entra ID join device registrations by a single user within a short time window.

## Strategy{% #strategy %}

This rule monitors Entra ID audit logs where `@ocsf.metadata.event_code` is `Register device`, `@ocsf.status` is `Success`, and `@properties.additionalDetails.value` is `Azure AD join`. The detection triggers when a single `@ocsf.actor.user.email_addr` registers three or more devices within a fifteen-minute evaluation window. Bulk device registration from one account is atypical for legitimate endpoint onboarding and aligns with device code phishing campaigns where an attacker registers multiple devices after compromising a user's consent to a device code prompt.

## Triage and response{% #triage-and-response %}

- Identify the user account `{{@ocsf.actor.user.email_addr}}` responsible for the registrations and verify whether a bulk device enrollment or migration project was scheduled.
- Review the list of registered device names in `@properties.targetResources.displayName` and determine whether they belong to known corporate assets or share suspicious naming patterns.
- Examine recent non-interactive sign-in logs for `{{@ocsf.actor.user.email_addr}}` where `@properties.originalTransferMethod` is `deviceCodeFlow` to confirm whether device code authentication preceded the registrations.
- Check whether the registered devices are unmanaged and whether conditional access policies should have restricted their enrollment.
- Determine whether the same user reported a suspicious sign-in prompt or MFA fatigue attempt prior to the registration burst.