New federation/trust added to tenant after risky privileged sign-in
Detects modifications to domain federation settings or the addition of new identity providers in Entra ID occurring within 24 hours of a risky sign-in event by the same user account. This behavior is indicative of a persistence mechanism involving MFA bypass via federated authentication, often referred to as a 'Golden SAML' or 'Federated Identity Backdoor' technique.
Microsoft Sentinel (KQL)
