Microsoft 365 - Modification of Trusted Domain





Set up the azure integration.


Detects when a user creates or modifies a trusted domain object in Microsoft 365.


Monitor Azure AD Audit logs for the following

  • Set federation settings on domain
  • Set domain authentication

Monitor Microsoft 365 Audit logs for the following

  • Set federation settings on domain.
  • Set domain authentication.

An attacker can create a new attacker-controlled domain as federated or modify the existing federation settings for a domain by configuring a new, secondary signing certificate. Both of these techniques would allow the attacker to authenticate as any user bypassing authentication requirements like a valid password or MFA.

Triage and response

  1. Determine if {{}} should have made a {{}} API call.
  2. If the API call was not made by the user:
    • Remove the suspicious domain or settings.
    • Begin your organization’s Incident Response (IR) process.
  3. If the API call was made by the user:
    • Ensure the change was authorized.