Azure Admin Registered Security Info
Records an administrator registering user authentication information.
T1556.006: Multi-Factor Authentication
T1556.006: Multi-Factor Authentication
Adversaries may disable or modify multi-factor authentication (MFA) mechanisms to enable persistent access to compromised accounts.
View on MITRE ATT&CK →AWS DeactivateMFADevice
Deactivates a specified MFA device and removes its association with a user.
AWS DeleteVirtualMFADevice
Deletes an unassigned virtual MFA device resource.
Azure Disable Strong Authentication
Records removal of a user’s per-user MFA requirement.
Azure Update User Authentication Methods
Records changes to a user’s registered Entra authentication methods.