---
title: Azure AD Identity Governance connected organization added
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Azure AD Identity Governance connected
  organization added
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Azure AD Identity Governance connected organization added
Classification:attackTactic:[TA0003-persistence](https://attack.mitre.org/tactics/TA0003)Technique:[T1098-account-manipulation](https://attack.mitre.org/techniques/T1098) 
## Goal{% #goal %}

Detects the creation of a new connected organization in Microsoft Entra ID Identity Governance.

## Strategy{% #strategy %}

This rule monitors Microsoft Entra ID audit logs for the `Create connected organization` action. A connected organization in Identity Governance defines an external partner tenant whose users or groups become eligible to request access packages through entitlement management, expanding the pool of external identities that can be granted access to internal resources.

## Triage & Response{% #triage--response %}

- Examine whether `{{@ocsf.actor.user.uid}}` has a legitimate business justification for configuring `{{@properties.targetResources.displayName}}` as a connected organization.
- Review the access packages and entitlements associated with `{{@properties.targetResources.displayName}}` to determine what internal resources external users could gain access to.
- Determine whether the external tenant represented by `{{@properties.targetResources.displayName}}` corresponds to a known, approved business partner.
- Check for related Identity Governance activity around the same time, such as new access package creation or policy changes involving the same connected organization.
- Verify whether `{{@ocsf.actor.user.uid}}`'s account shows signs of compromise, such as anomalous sign-in activity, preceding this configuration change.