---
title: Entra ID federated credential added to Azure application by user
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Entra ID federated credential added to
  Azure application by user
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Entra ID federated credential added to Azure application by user
Classification:attackTactic:[TA0003-persistence](https://attack.mitre.org/tactics/TA0003)Technique:[T1098-account-manipulation](https://attack.mitre.org/techniques/T1098) 
## Goal{% #goal %}

Detect when a user account adds a federated identity credential (FIC) to an application registration. This may indicate an attacker preparing to use an application for privilege escalation or persistence.

## Strategy{% #strategy %}

Monitor Microsoft Entra ID audit logs for the following event, `Update application`, where the `modifiedProperties` of the event contains `FederatedIdentityCredentials`. For further information on attacks using federated credentials, review [Persisting on Entra ID applications and User Managed Identities with Federated Credentials][1].

## Triage and response{% #triage-and-response %}

1. Determine if this user was expected to manage this application.
1. Check for other signals and logs generated by the impacted user `{{@usr.id}}`, and look for deviations in the following properties:
   - Application
   - Device
   - Geolocation
   - IP address
   - User agent
1. Reach out to the user `{{@usr.id}}` to confirm if they recognize the activity.
1. If the activity is not legitimate:
   - Remove the suspicious key.
   - Invalidate all existing refresh tokens.
   - Initiate your incident response process for further investigation.

[1] [https://dirkjanm.io/persisting-with-federated-credentials-entra-apps-managed-identities/](https://dirkjanm.io/persisting-with-federated-credentials-entra-apps-managed-identities/)