M365 Copilot Access from Non-Compliant Devices

This detection identifies instances where users access M365 Copilot from devices that do not meet corporate compliance standards. This can expose sensitive organizational data. The activity is identified by analyzing M365 Copilot Graph API logs for access events originating from devices flagged as either non-compliant (deviceDetail.isCompliant=false) or unmanaged (deviceDetail.isManaged=false). The detection aggregates information by user, operating system, and browser to provide context around the non-compliant access. The goal is to uncover potential shadow IT usage, violations of Bring Your Own Device (BYOD) policies, or compromised endpoints accessing corporate resources through M365 Copilot. This detection is based on version 4 of the Splunk ESCU detection e26bc52d-9cbc-4743-9745-e8781d935042.

Attack Chain

1. User attempts to access Microsoft 365 Copilot application.
2. Azure AD evaluates device compliance and management status during authentication.
3. If the device is not compliant (deviceDetail.isCompliant=false) or unmanaged (deviceDetail.isManaged=false), the sign-in attempt is logged in Azure AD Sign-in logs.
4. The M365 Copilot Graph API captures the sign-in event and its associated device details.
5. Security monitoring tools ingest the M365 Copilot Graph API logs.
6. The detection identifies events where deviceDetail.isCompliant or deviceDetail.isManaged is false while accessing Copilot.
7. The detection aggregates the data by user, device operating system, and browser to highlight patterns of non-compliant access.
8. Security teams are alerted to the potential policy violations or compromised endpoints accessing M365 Copilot.

Impact

Successful exploitation can lead to data leakage, unauthorized access to sensitive information, and violation of corporate security policies. The number of affected users and the sensitivity of data accessed depend on the organization's M365 Copilot usage and the data accessible through Copilot. Organizations may face compliance violations and regulatory fines if sensitive data is accessed from non-compliant devices. This situation impacts the security domain of endpoints, which can introduce threats into web applications and expose company data.

Recommendation

• Ensure the Splunk Add-on for Microsoft Office 365 is properly configured to ingest Azure AD Sign-in logs via the Graph API, as described in the "how_to_implement" section.
• Deploy the Sigma rule M365 Copilot Access from Non-Compliant Devices to detect unauthorized access attempts and tune it for your environment.
• Investigate users flagged by the detection, focusing on devices labeled as non-compliant or unmanaged in the M365 Copilot Graph API logs.
• Develop or refine BYOD policies to address the risks of accessing corporate resources from personal devices and communicate these policies clearly to employees.
• Implement stricter Conditional Access policies in Azure AD to block access to M365 Copilot from non-compliant or unmanaged devices, using device compliance as a condition.
• Regularly review and update device compliance policies to ensure they align with current security best practices.