New Defender for Identity security alerts
Analysis / inference: Microsoft Defender for Identity has introduced new security alerts focusing on Entra ID guest promotion, credential abuse, and session cookie theft.
- Dates
- Source and collection dates not recorded
- Source
- Microsoft Defender for Identity - What's new · Limited verification
- Classification
- Microsoft Security
Section 01 · Summary analysis
Microsoft released several new security alert categories covering Entra ID guest user promotion, randomized user agent sign-ins, session cookie theft, and MFA method manipulation.
AI summary / analysis; claims are not independently verified. Check the primary source before acting.
Section 02 · Analysis
SecOps Signal analysisThese newly introduced security alerts expand SOC visibility into hybrid cloud threats, specifically covering Entra ID privilege escalation, credential abuse, and session hijacking vectors.
SOC teams will see expanded coverage and potentially new incident volumes related to hybrid identity and Entra ID authentication anomalies.
Section 03 · Recommended actions
- Update SIEM correlation rules to ingest the new Defender for Identity alert types.
- Familiarize SOC analysts with the triage steps for newly introduced Entra ID authentication and credential abuse alerts.
- Review Defender for Identity console configurations to ensure the new alert types are enabled and correctly mapped to SIEM forwarding rules.
- Verify incident triage playbooks handle the newly added Entra ID alerts such as guest user promotion and stolen session cookie indicators.