Skip to content

AZT502.1 - Account Creation: Guest Account Creation#

An adversary may create a guest account in Azure Active Directory

Resource

Azure Active Directory

Actions

  • microsoft.directory/users/create
  • microsoft.directory/users/inviteGuest

Examples

newuser

Detections

Logs#

Data Source Operation Name Action Log Location
Azure Active Directory Invited Users microsoft.directory/users/inviteGuest AzureAD Audit Logs

Queries#

AuditLogs| where ActivityDisplayName == "Invited Users"