Incident ReportsIR
IR-2025-002
MED

Identity — 7-Property Anomaly (No Device ID)

FILED:Dec 2025
TAXONOMY:T1078.004
Complexity:Standard
~17h containment
~6m read
SUSPICIOUS ACTIVITY — PRECAUTIONARY CONTAINMENT

Microsoft Sentinel generated an alert for unfamiliar sign-in properties associated with a service-type user account. The sign-in occurred from a UK-based IP with no prior history in the user's 30-day baseline and no Device ID. All seven sign-in properties were simultaneously unfamiliar. No self-remediation event observed. RF Score indeterminate. Escalated as caution — client confirmed account disabled as precautionary measure. No compromise confirmed.

IdentityEntraService AccountM365
Outcome
Account disabled — further sign-in attempts blocked regardless of credential validity
No compromise confirmed — precautionary containment applied
Background & Context

Azure AD Identity Protection's unfamiliar sign-in detection flags when a sign-in's properties deviate from a user's established 30-day baseline. Seven properties are assessed simultaneously: ASN, Browser, Device, IP, Location, EASId (Exchange Active Sync ID), and TenantIPsubnet. When all seven are simultaneously unfamiliar, Identity Protection generates a maximum-confidence anomaly signal.

Service accounts present a heightened risk profile in this scenario. Unlike regular user accounts — where some variation in sign-in properties may reflect travel, home working, or device changes — service accounts exhibit fundamentally static, predictable access patterns. They sign in from fixed infrastructure on scheduled intervals. Any deviation from this pattern is inherently suspicious and warrants escalation.

The absence of a Device ID is a particularly meaningful signal in a managed Microsoft 365 environment. In such environments, corporate devices enrolled in Entra ID or Intune carry a Device ID in every sign-in event. Its absence indicates either an unregistered personal device or — in an attack scenario — an attacker using a clean machine specifically to avoid device fingerprint detection.

Triage Thought Process
01Baseline first. Check the 30-day sign-in history before doing anything else. If the alert IP had appeared even once before, classification changes entirely.
02Zero baseline history = escalation threshold met. The alert IP had never appeared. Combined with no Device ID, this is a maximum-unfamiliarity event — all 7 sign-in properties simultaneously unknown.
03RF Indeterminate is not a safe signal. Absence of threat intelligence data does not mean the IP is clean — it means it has no reported history. Common for newly provisioned infrastructure, residential connections, or proxies.
04No Device ID is a hard signal. In a managed M365 environment, all legitimate sign-ins from enrolled devices carry a Device ID. Its absence indicates either a non-managed device or an attacker using a clean machine to avoid fingerprinting.
05No self-remediation event is a red flag. When users are notified of suspicious activity, a self-remediation event typically follows. Its absence suggests the account owner was unaware of the sign-in attempt.
06Service accounts have static patterns. Service accounts do not exhibit variable sign-in behaviour by design. Any deviation, especially outside business hours, warrants immediate escalation.
Decision
Escalate with recommended immediate account disablement. Three independent unknowns — zero baseline history, no Device ID, indeterminate RF — with no mitigating familiar attribute is sufficient grounds regardless of confirmed compromise.
Incident Timeline
09 Dec, 17:54
Alert triggered: Unfamiliar sign-in properties — Azure AD Identity Protection (7 properties flagged)
09 Dec, 18:00
Ticket opened and assigned to analyst on evening shift
09 Dec, 18:05
Sign-in IP enriched via Recorded Future — RF Score: Indeterminate, no location data, no ASN data
09 Dec, 18:10
30-day sign-in history reviewed — stable baseline from two known London/Home Counties IPs
09 Dec, 18:15
Confirmed: alert IP has zero historical presence in account's activity baseline
09 Dec, 18:18
No Device ID on session — sign-in from unregistered or non-managed device confirmed
09 Dec, 18:20
No self-remediation event observed — no password reset, MFA challenge, or session revoke
09 Dec, 18:25
Escalation sent to client contact with recommended containment actions
10 Dec, ~09:30
Client security team responds — account reviewed and disabled as precaution
10 Dec, ~11:00
Ticket reviewed and closed — precautionary containment confirmed
Technical Analysis

The affected account's 30-day sign-in summary showed a consistent and stable baseline: the vast majority of sign-ins originated from two known IP addresses geolocating to Greater London or a Home Counties location consistent with the organisation's office footprint.

The alert IP (176[.]251[.]176[.]XXX) returned no Recorded Future intelligence — RF Score: Indeterminate, Location: Not Available, ASN: Not Available. The absence of any threat intelligence data does not indicate safety; it suggests the IP has not been observed in threat feeds, which is common for newly provisioned infrastructure, residential connections, or proxies not yet reported to intelligence communities.

The sign-in had no associated Device ID. In Azure AD, a Device ID is present when the sign-in occurs from a device that has been Entra-joined, Intune-registered, or compliant with MDM policy. The absence indicates one of: (a) a personal unregistered device, (b) a browser-based sign-in from a non-managed device, or (c) an attacker using a clean machine or virtual environment to avoid device fingerprint detection.

All seven unfamiliar sign-in property indicators were simultaneously flagged — this represents a maximum-unfamiliarity configuration. There is no single known attribute to provide contextual confidence in the legitimacy of the sign-in.

No risky events were recorded in the AADUserRiskEventsTable for this account prior to this event. No self-remediation actions were logged (no password reset, no MFA challenge response, no session block). In cases where a user is notified of suspicious activity, a self-remediation event typically follows. Its absence suggests the account owner was unaware of the sign-in attempt, further reducing the probability this was a legitimate user action.

The IP geolocated within the UK, which marginally reduces the probability of a geographically distant attack, but does not rule out the use of a UK-based VPN, residential proxy, or compromised intermediary host.

Environment
Microsoft Sentinel — Azure AD Identity Protection
Microsoft 365 / Azure AD
Recorded Future (IP enrichment)
Signals
All 7 unfamiliar sign-in properties flagged simultaneously: ASN, Browser, Device, IP, Location, EASId, TenantIPsubnet
No Device ID — sign-in from unregistered or non-managed device
No self-remediation event observed post-alert
Sign-in at 17:54 UTC — outside standard business hours
Alert IP: RF Score Indeterminate — no location or ASN data
What I Checked
30-day baseline reviewed — stable pattern from two known London/Home Counties IPs
Alert IP: zero historical presence in account's sign-in baseline
IP enriched via Recorded Future: RF Score Indeterminate — no location or ASN data available
No Device ID confirmed — sign-in from unregistered or non-managed device
All 7 unfamiliar sign-in property indicators verified on the alert event
Self-remediation events checked — none observed (no password reset, MFA challenge response, or session revoke)
AADUserRiskEventsTable checked — no prior risky events for this account
Actions Taken
Escalation sent to client contact with recommended immediate account disablement
Client confirmed account disabled as precautionary measure
Recommended full credential reset, MFA method review, and suspicious session audit
Recommended Conditional Access device compliance requirement for service accounts
Recommended risk-based Conditional Access to auto-block medium/high sign-in risk on service accounts
Indicators of Compromise
TypeIndicatorNotes
IP Address176[.]251[.]176[.]XXXRF Score: Indeterminate — no location or ASN data available
Session AnomalyNo Device ID presentSign-in from unregistered or non-compliant device
Session AnomalyAll 7 sign-in properties unfamiliarASN, Browser, Device, IP, Location, EASId, TenantIPsubnet — maximum-unfamiliarity event
Account[SERVICE ACCOUNT — REDACTED]Service or shared-function account type
Time17:54 UTC, 09 Dec 2025Evening sign-in — outside standard business hours
MITRE ATT&CK Mapping
TacticTechniqueIDObserved
Initial AccessValid Accounts: Cloud AccountsT1078.004Sign-in using valid credentials from anomalous IP with no device registration
Defense EvasionUse Alternate Authentication MaterialT1550No registered device suggests clean machine or virtual environment to avoid device fingerprint detection
DiscoveryAccount Discovery: Cloud AccountT1087.004If successful, service account access could enable tenant enumeration
Detection Logic (KQL)
// 30-day sign-in baseline for service account
SigninLogs
| where UserPrincipalName == "[SERVICE_ACCOUNT_UPN]"
| where TimeGenerated > ago(30d)
| summarize Count=count() by IPAddress, Location,
  DeviceId = tostring(DeviceDetail.deviceId), ASN = tostring(NetworkLocationDetails)
| order by Count desc

// Confirm all 7 unfamiliar properties on the alert event
AADUserRiskEvents
| where UserPrincipalName == "[SERVICE_ACCOUNT_UPN]"
| where TimeGenerated > ago(7d)
| project TimeGenerated, RiskEventType, RiskLevel, IpAddress, Location, AdditionalInfo

// Confirm no self-remediation events post-alert
AuditLogs
| where TimeGenerated > datetime(2025-12-09T17:54:00Z)
| where InitiatedBy.user.userPrincipalName == "[SERVICE_ACCOUNT_UPN]"
| where OperationName in ("Change user password","Reset user password","Revoke all refresh tokens for user")
| project TimeGenerated, OperationName, Result
Analyst NotesMuhammad Fezzan

The combination of a completely unfamiliar IP (no RF context, no ASN), zero Device ID, and no self-remediation event was sufficient to treat this as a potential account compromise. Service accounts do not exhibit variable sign-in behaviour by design — their access patterns are predictable. Any deviation, especially outside business hours, warrants immediate escalation.

The IP geolocated within the UK, which marginally reduces the probability of a geographically distant nation-state attack, but does not rule out the use of a UK-based VPN, residential proxy, or compromised intermediary host as an anonymisation layer.

Client's account disablement was correct. The recommended Conditional Access changes would prevent this class of alert from requiring analyst escalation in future — automated containment is the right long-term answer here.

Lessons Learned
Service accounts require stricter Conditional Access — standard user policies may not apply to service account types.
Indeterminate RF Scores are not benign signals — absence of threat intelligence does not mean an IP is safe.
No Device ID is a high-confidence indicator in a managed M365 environment.
Enable Continuous Access Evaluation (CAE) for service accounts for real-time session revocation.
Conduct a service account audit — review all for least-privilege access, remove stale accounts, enforce MFA.
Recommendations
R1Implement device compliance Conditional Access for all service accounts: sign-ins from non-Entra-joined or non-Intune-compliant devices should be blocked or require step-up authentication, eliminating the clean-device attack vector.
R2Configure risk-based Conditional Access for service accounts: automatic block at medium or higher sign-in risk scores removes the analyst escalation dependency for time-sensitive identity events.
R3Enable Continuous Access Evaluation (CAE) for service accounts: ensures real-time session revocation upon risk event detection without waiting for token expiry.
R4Conduct a service account audit: review all service and shared accounts for least-privilege access, remove stale accounts, and ensure MFA is registered and enforced on all accounts with human-usable credentials.
SIG
Case Certification
Muhammad Fezzan
SOC ANALYST
DIGITAL TIMESTAMP
DEC 2025 // REG-002-FS
← All incidentsCase anonymised