Classification:

attack

Tactic:

TA0003-persistence

Technique:

T1098-account-manipulation

VIEW RULE IN DATADOG VIEW SIGNALS

Goal

Detects the creation of a new connected organization in Microsoft Entra ID Identity Governance.

Strategy

This rule monitors Microsoft Entra ID audit logs for the Create connected organization action. A connected organization in Identity Governance defines an external partner tenant whose users or groups become eligible to request access packages through entitlement management, expanding the pool of external identities that can be granted access to internal resources.

Triage & Response

• Examine whether {{@ocsf.actor.user.uid}} has a legitimate business justification for configuring {{@properties.targetResources.displayName}} as a connected organization.
• Review the access packages and entitlements associated with {{@properties.targetResources.displayName}} to determine what internal resources external users could gain access to.
• Determine whether the external tenant represented by {{@properties.targetResources.displayName}} corresponds to a known, approved business partner.
• Check for related Identity Governance activity around the same time, such as new access package creation or policy changes involving the same connected organization.
• Verify whether {{@ocsf.actor.user.uid}}’s account shows signs of compromise, such as anomalous sign-in activity, preceding this configuration change.