AZT507.2 - External Entity Access: Microsoft Partners

Adversaries may use Delegated Administrative Privileges to give themselves administrator access to the target tenant.

Resource

AzureAD

Actions

• N/A

Examples

• N/A

Detections

Detection Details

By reviewing access logs in AzureAD, a key indicator is identifying logins from users that do not contain a domain linked to the tenant.

Additional Resources

• https://docs.microsoft.com/en-us/microsoft-365/commerce/manage-partners?view=o365-worldwide

• https://o365blog.com/post/partners/