---
title: M365 Entra ID Risk Detection Signal
description: Identifies Microsoft Entra ID (formerly Azure AD) risk detection signals including risky sign-ins, compromised credentials, impossible travel, and other...
url: https://www.elastic.co/docs/reference/security/prebuilt-rules/rules_building_block/credential_access_entra_id_risk_detection_signal
products:
  - Elastic Security
---

# M365 Entra ID Risk Detection Signal
Identifies Microsoft Entra ID (formerly Azure AD) risk detection signals including risky sign-ins, compromised
credentials, impossible travel, and other identity-based anomalies. These events indicate potential credential
compromise, account takeover attempts, or suspicious authentication patterns detected by Microsoft's identity
protection. This building block rule generates security events for correlation, threat hunting, and telemetry
collection to support detection of credential access and initial access attempts.
**Rule type**: query
**Rule indices**:
- logs-o365.audit-*
- filebeat-*

**Rule Severity**: low
**Risk Score**: 21
**Runs every**: 
**Searches indices from**: `now-9m`
**Maximum alerts per execution**: 100
**References**:
- [[https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks](https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks)](https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks)
- [[https://learn.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-schema#enum-auditlogrecordtype---type-edmint32](https://learn.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-schema#enum-auditlogrecordtype---type-edmint32)](https://learn.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-schema#enum-auditlogrecordtype---type-edmint32)

**Tags**:
- Domain: Cloud
- Domain: SaaS
- Data Source: Microsoft 365
- Data Source: Microsoft 365 Audit Logs
- Data Source: Microsoft Entra ID
- Data Source: Microsoft Entra ID Protection
- Use Case: Threat Detection
- Use Case: Identity Threat Detection
- Tactic: Credential Access
- Tactic: Initial Access
- Rule Type: BBR
- Rule Type: Custom Query (KQL)
- Platform: Microsoft 365

**Version**: 3
**Rule authors**:
- Elastic

**Rule license**: Elastic License v2

### Additional notes

For information on troubleshooting the maximum alerts warning please refer to this [guide](https://www.elastic.co/guide/en/security/current/alerts-ui-monitor.html#troubleshoot-max-alerts).

## Rule Query

```kuery
event.dataset:o365.audit and event.code:AadRiskDetection
```

**Framework:** MITRE ATT&CK
- Tactic:
  - Name: Credential Access
  - Id: TA0006
  - Reference URL: [[https://attack.mitre.org/tactics/TA0006/](https://attack.mitre.org/tactics/TA0006/)](https://attack.mitre.org/tactics/TA0006/)
- Technique:
  - Name: Brute Force
  - Id: T1110
  - Reference URL: [[https://attack.mitre.org/techniques/T1110/](https://attack.mitre.org/techniques/T1110/)](https://attack.mitre.org/techniques/T1110/)
- Sub Technique:
  - Name: Password Spraying
  - Id: T1110.003
  - Reference URL: [[https://attack.mitre.org/techniques/T1110/003/](https://attack.mitre.org/techniques/T1110/003/)](https://attack.mitre.org/techniques/T1110/003/)

**Framework:** MITRE ATT&CK
- Tactic:
  - Name: Initial Access
  - Id: TA0001
  - Reference URL: [[https://attack.mitre.org/tactics/TA0001/](https://attack.mitre.org/tactics/TA0001/)](https://attack.mitre.org/tactics/TA0001/)
- Technique:
  - Name: Valid Accounts
  - Id: T1078
  - Reference URL: [[https://attack.mitre.org/techniques/T1078/](https://attack.mitre.org/techniques/T1078/)](https://attack.mitre.org/techniques/T1078/)
- Sub Technique:
  - Name: Cloud Accounts
  - Id: T1078.004
  - Reference URL: [[https://attack.mitre.org/techniques/T1078/004/](https://attack.mitre.org/techniques/T1078/004/)](https://attack.mitre.org/techniques/T1078/004/)