Azure Device Registration Policy Modification
This rule detects changes to the device registration policy within Azure. Such modifications can be used by adversaries to evade defenses, escalate privileges, or enable unauthorized device registrations, potentially leading to broader access to the environment. The detection specifically looks for 'Set device registration policies' activity within the 'Policy' category of Azure Audit Logs.
Sigma
