Skip to content
TheCloud.Events

Add Verified Domain

Azure

Add Verified Domain

service: Azure - Microsoft Entra ID
tactics:
Persistence
techniques:
tags:
Azure Microsoft Entra ID

Event

Adds a custom domain to a Microsoft Entra ID tenant and initiates the domain verification process.

Security Context

  • This action can establish persistent access mechanisms that survive credential rotation and remain active until explicitly discovered and removed.

Log Source

Entra ID Audit Logs

Sample Event

Legitimate. IAM admin Hermione Granger adds and verifies a new vanity domain partners.fantasticlogs.cloud for a partner-onboarding initiative. The DNS TXT record verification has just completed, so this audit entry is the Add verified domain activity (a separate Add unverified domain event would have fired earlier when the domain was first added). Authentication type defaults to Managed.

{
  "id": "Directory_90000000-0000-4000-8000-000001101101_3A8C1_72584931",
  "category": "DirectoryManagement",
  "correlationId": "90000000-0000-4000-8000-000001101101",
  "result": "success",
  "resultReason": "",
  "activityDisplayName": "Add verified domain",
  "activityDateTime": "2026-04-15T11:32:18.5072194Z",
  "loggedByService": "Core Directory",
  "operationType": "Update",
  "tenantId": "10000000-0000-4000-8000-000000000001",
  "initiatedBy": {
    "app": null,
    "user": {
      "id": "30000000-0000-4000-8000-000000000001",
      "displayName": "Hermione Granger",
      "userPrincipalName": "hermione@fantasticlogs.cloud",
      "ipAddress": "198.51.100.42",
      "userType": "Member",
      "homeTenantId": "10000000-0000-4000-8000-000000000001",
      "homeTenantName": null
    }
  },
  "targetResources": [
    {
      "id": "partners.fantasticlogs.cloud",
      "displayName": "partners.fantasticlogs.cloud",
      "type": "Domain",
      "userPrincipalName": null,
      "groupType": null,
      "modifiedProperties": [
        {
          "displayName": "DomainName",
          "oldValue": "[]",
          "newValue": "[\"partners.fantasticlogs.cloud\"]"
        },
        {
          "displayName": "IsVerified",
          "oldValue": "[false]",
          "newValue": "[true]"
        },
        {
          "displayName": "AuthenticationType",
          "oldValue": "[]",
          "newValue": "[\"Managed\"]"
        },
        {
          "displayName": "IsDefault",
          "oldValue": "[]",
          "newValue": "[false]"
        },
        {
          "displayName": "Included Updated Properties",
          "oldValue": null,
          "newValue": "\"DomainName, IsVerified, AuthenticationType, IsDefault\""
        }
      ]
    }
  ],
  "additionalDetails": [
    {
      "key": "User-Agent",
      "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36"
    }
  ]
}

MITRE ATT&CK Mapping

Tactics: Persistence

same service (Azure - Microsoft Entra ID)
Add App Role Assignment To Service Principal Add Application Add Eligible Member To Role In Pim Completed Add Federated Identity Credential Add Member To Role Add Owner To Application Add Owner To Group Add Service Principal +10 more