---
title: Azure AD Identity Governance custom task extension created
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Azure AD Identity Governance custom
  task extension created
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Azure AD Identity Governance custom task extension created
Classification:attackTactic:[TA0003-persistence](https://attack.mitre.org/tactics/TA0003)Technique:[T1098-account-manipulation](https://attack.mitre.org/techniques/T1098) 
## Goal{% #goal %}

Detects when a user creates a custom task extension in Microsoft Entra Identity Governance.

## Strategy{% #strategy %}

This rule monitors Microsoft Entra ID audit logs for the `@ocsf.metadata.event_code` value `Create custom task extension`. Custom task extensions in Identity Governance Lifecycle Workflows invoke Logic Apps as part of access-package and lifecycle-workflow tasks. Because these extensions execute automatically and unattended once configured, an attacker with sufficient administrative rights could register one to establish low-visibility persistence.

## Triage and response{% #triage-and-response %}

- Determine if `{{@ocsf.actor.user.uid}}` should have permissions to create custom task extensions in Identity Governance.
- Identify the Logic App and workflow task associated with the newly created custom task extension, and review what actions it is configured to perform.
- Check whether the associated Logic App was recently created or modified, and review its connectors and credentials for signs of tampering.
- If the custom task extension was not authorized, disable or delete it, review the Logic App run history for unauthorized executions, and begin your organization's Incident Response (IR) process.