Azure and Entra ID abuse: are your detection controls keeping up?

TL;DR: Azure Activity, Entra ID, and Storage telemetry can be combined to detect privilege escalation, credential abuse, persistence, and exfiltration techniques in Microsoft Azure environments, according to Wazuh. The operational gap is not visibility in theory but whether identity, role, and storage events are collected and correlated quickly enough to surface abuse before it becomes persistent access.

NHIMG editorial — based on content published by Wazuh: Detecting Azure and Entra ID abuse through telemetry and rules

By the numbers:

• Only 5.7% of organisations have full visibility into their service accounts.
• 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage.
• 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job.

Questions worth separating out

Q: What breaks when Azure identity changes are not monitored as security events?

A: Attackers can add secrets, federated credentials, or role assignments that create durable access while looking like routine administration.

Q: Why do Entra ID credential additions create persistent cloud risk?

A: Because a new secret or federated credential can let an attacker authenticate as the application long after the original compromise is gone.

Q: How do security teams know whether Azure telemetry is actually helping?

A: They should test whether detections can connect identity changes, privilege escalation, and storage access into one investigation trail.

Practitioner guidance

• Alert on application credential creation and federated credential changes Create high-fidelity detections for new client secrets, federated identity credentials, and unexpected application updates in Entra ID.
• Correlate role assignment changes with identity and storage events Join Azure Activity logs, Entra ID Audit logs, Sign-in logs, and Storage diagnostics so privilege escalation can be traced into exfiltration or resource tampering.
• Watch for root-scope elevation and resource lock removal Prioritise detections for elevated access, lock deletion, and administrative policy changes because these often precede lateral privilege use or destructive impact.

What's in the full article

Wazuh's full blog post covers the operational detail this post intentionally leaves for the source:

• Step-by-step Azure and Entra ID log integration using a Log Analytics workspace and the azure-logs module
• Custom Wazuh rule logic for service principal credential creation, federated identity changes, and disk export events
• Exact diagnostic settings and log categories used for Azure Activity, AuditLogs, SignInLogs, and StorageBlobLogs
• Stratus Red Team command examples for reproducing privilege escalation, persistence, and exfiltration techniques

👉 Read Wazuh's Azure and Entra ID detection guide for cloud abuse techniques →

Azure and Entra ID abuse: are your detection controls keeping up?

Explore further

View Full Forum →  |  NHI Foundation Course →