---
title: Entra ID device registration by unusual user agent
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Entra ID device registration by unusual
  user agent
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Entra ID device registration by unusual user agent
Classification:attackTactic:[TA0003-persistence](https://attack.mitre.org/tactics/TA0003)Technique:[T1098-account-manipulation](https://attack.mitre.org/techniques/T1098) 
## Goal{% #goal %}

Detects Entra ID `Azure AD join` device registration performed with a non-standard user agent for the registering user.

## Strategy{% #strategy %}

This rule monitors Entra ID audit activity where `@ocsf.activity_name` is `Register device`. It excludes registrations where `@http.useragent` matches expected operating-system clients (`Dsreg*`, `DeviceRegistrationClient`, or `Dalvik*`).

Legitimate Azure AD join flows typically use these built-in registration clients; registrations from other user agents can reflect scripted or tool-driven enrollment used to establish a trusted device for persistence.

## Triage & Response{% #triage--response %}

- Contact `{{@ocsf.actor.user.email_addr}}` to confirm whether they intentionally joined a device to Entra ID during the alert timeframe.
- Review the `@http.useragent` value on the registration event and determine whether it matches a known corporate endpoint management tool or an unexpected client library, script, or browser.
- Examine the registered device details in Entra ID, including device name, ownership, and compliance state, and compare them to devices normally associated with `{{@ocsf.actor.user.email_addr}}`.
- Check `{{@network.client.ip}}`, geographic location, and authentication context around the registration for deviation from the user's typical sign-in patterns.
- Review recent Entra ID audit and sign-in activity for `{{@ocsf.actor.user.email_addr}}` for other account manipulation, consent grants, or conditional access policy changes near the registration time.
- Identify whether other users registered devices from the same `@http.useragent` or `{{@network.client.ip}}` to assess broader unauthorized enrollment activity.