Skip to content
TheCloud.Events

Add Verified Domain

Azure

Add Verified Domain

service: Azure - Microsoft Entra ID
tactics:
Privilege Escalation Defense Impairment
techniques:
T1484.002
tags:
Azure Microsoft Entra ID

Event

Adds a custom domain to a Microsoft Entra ID tenant and initiates the domain verification process.

Security Context

  • Adding and verifying a domain becomes a trust-modification vector when the domain is configured as Federated rather than Managed: an adversary who controls a federated domain can mint SAML tokens for any user in the tenant (the “Golden SAML” / AADInternals technique), impersonating identities without their credentials.
  • The sample below is the benign Managed-authentication baseline; the notable variant is an AuthenticationType of Federated with an attacker-controlled issuer and signing certificate.

Log Source

Entra ID Audit Logs

Sample Event

Legitimate. IAM admin Hermione Granger adds and verifies a new vanity domain partners.fantasticlogs.cloud for a partner-onboarding initiative. The DNS TXT record verification has just completed, so this audit entry is the Add verified domain activity (a separate Add unverified domain event would have fired earlier when the domain was first added). Authentication type defaults to Managed.

{
  "id": "Directory_90000000-0000-4000-8000-000001101101_3A8C1_72584931",
  "category": "DirectoryManagement",
  "correlationId": "90000000-0000-4000-8000-000001101101",
  "result": "success",
  "resultReason": "",
  "activityDisplayName": "Add verified domain",
  "activityDateTime": "2026-04-15T11:32:18.5072194Z",
  "loggedByService": "Core Directory",
  "operationType": "Update",
  "initiatedBy": {
    "app": null,
    "user": {
      "id": "30000000-0000-4000-8000-000000000001",
      "displayName": "Hermione Granger",
      "userPrincipalName": "hermione@fantasticlogs.cloud",
      "ipAddress": "198.51.100.42"
    }
  },
  "targetResources": [
    {
      "id": "partners.fantasticlogs.cloud",
      "displayName": "partners.fantasticlogs.cloud",
      "userPrincipalName": null,
      "groupType": null,
      "modifiedProperties": [
        {
          "displayName": "DomainName",
          "oldValue": "[]",
          "newValue": "[\"partners.fantasticlogs.cloud\"]"
        },
        {
          "displayName": "IsVerified",
          "oldValue": "[false]",
          "newValue": "[true]"
        },
        {
          "displayName": "AuthenticationType",
          "oldValue": "[]",
          "newValue": "[\"Managed\"]"
        },
        {
          "displayName": "IsDefault",
          "oldValue": "[]",
          "newValue": "[false]"
        },
        {
          "displayName": "Included Updated Properties",
          "oldValue": null,
          "newValue": "\"DomainName, IsVerified, AuthenticationType, IsDefault\""
        }
      ]
    }
  ],
  "additionalDetails": [
    {
      "key": "User-Agent",
      "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36"
    }
  ]
}

MITRE ATT&CK Mapping

Tactics: Privilege Escalation Defense Impairment

Techniques:
  • T1484.002 — Trust Modification — Adversaries may add new domain trusts, modify the properties of existing domain trusts, or otherwise change the configuration of trust relationships between domains and tenants to evade defenses and/or elevate privileges.Trust details, such as whether or not user identities are federated, allow a...
shares T1484.002 — Trust Modification
CreateOpenIDConnectProvider CreateSAMLProvider UpdateAssumeRolePolicy
same service (Azure - Microsoft Entra ID)
Add App Role Assignment To Service Principal Add Application Add Eligible Member To Role In Pim Completed Add Federated Identity Credential Add Member To Role Add Owner To Application Add Owner To Group Add Service Principal +10 more