EIDSCA.AG03: Authentication Method - General Settings - Report suspicious activity - Included users/groups.
| ID | EIDSCA.AG03 |
| Severity | Medium |
| Suite | EIDSCA |
| Product | Entra ID |
| Feature | Authentication methods |
| Security area | Authentication |
| Resource type | Tenant |
| User impact of fixing | Low |
| Effort to fix | Low |
| MITRE ATT&CK | T1621, T1078.004 |
| Reads from | Microsoft Graph |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Object Id or scope of users which will be included to report suspicious activities if they receive an authentication request that they did not initiate.
Apply this feature to all users.
Test script
Section titled “Test script”https://graph.microsoft.com/beta/policies/authenticationMethodsPolicy.reportSuspiciousActivitySettings.includeTarget.id -eq 'all_users'Remediation action
Section titled “Remediation action”Microsoft Learn - Report suspicious activites
Related links
Section titled “Related links”- Open in Graph Explorer
- Get authenticationMethodsPolicy - Microsoft Graph v1.0 | Microsoft Learn
- View in Microsoft Entra admin center
Mito check, based on EIDSCA. Author: Cloud-Architekt. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.