---
title: New Owner added to Microsoft Entra ID application
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > New Owner added to Microsoft Entra ID
  application
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# New Owner added to Microsoft Entra ID application
Classification:attackTactic:[TA0003-persistence](https://attack.mitre.org/tactics/TA0003)Technique:[T1098-account-manipulation](https://attack.mitre.org/techniques/T1098) 
## Goal{% #goal %}

Detect when a user is added as a new owner for a Microsoft Entra ID application which could be used as a persistence mechanism.

## Strategy{% #strategy %}

Monitor Microsoft Entra ID logs for `@evt.name: "Add owner to application"` has an `@evt.outcome` of `success`.

## Triage and response{% #triage-and-response %}

1. Review evidence of anomalous activity for the user being added as an owner (`@properties.targetResources`) for the Microsoft Entra ID application.
1. Determine if there is a legitimate reason for the user being added to the application.