Microsoft 365: Federated domain creation
Monitoring for the addition of new federated domains in Microsoft 365, a technique associated with persistent unauthorized access and SAML-based identity provider manipulation.
Triage facts
Revision 1- Evidence
- Unknown
- Severity
- Medium
- Action
- Elevated
- Sources
- 5 public sources
- Freshness
- Revision 1Nov 10, 03:34 UTC
- Detection
- 1 rule
- Source quality
- A2Roughly even chance
The addition of a new federated domain in Microsoft 365 environment represents a significant configuration change that may indicate identity-based persistence or backdoor activity. Adversaries with administrative access can leverage federation to bypass standard authentication controls, a technique historically documented in campaigns involving SAML token manipulation.
Impact
Legitimate domain federation is a routine administrative task, but unauthorized modification of federation settings provides an attacker with the ability to issue identity tokens, effectively bypassing multi-factor authentication and maintaining long-term access to the target cloud environment.
Recommendation
- Implement monitoring for the 'Add-FederatedDomain' event within M365 Exchange audit logs to identify unauthorized federation changes.
- Establish a formal change management process for federation configurations and audit these changes periodically against authorized provisioning activity.
- Deploy the provided detection rule to alert on all instances of domain federation additions for manual investigation.
Immediate actions
Deploy Sigma rule to monitor for Add-FederatedDomain
Threat Hunt
Review audit logs for all Add-FederatedDomain events in the last 90 days
Data: M365 Unified Audit Logs
Detection coverage 1
Detect Addition of New Federated Domain
mediumDetects the successful addition of a new federated domain, which may indicate unauthorized identity persistence
Detection queries are available on the platform. Get full rules →