Add Verified Domain

CSP: Azure

Tactics:

Persistence

Techniques:

Tags:

Azure Microsoft Entra ID

Event

Adds a custom domain to a Microsoft Entra ID tenant and initiates the domain verification process.

Security Context

• This action can establish persistent access mechanisms that survive credential rotation and remain active until explicitly discovered and removed.

Log Source

Entra ID Audit Logs

Sample Event

MITRE ATT&CK Mapping

Tactics: Persistence