LoFP LoFP / rare edge cases during initial passwordless onboarding may briefly produce a windows hello for business or passkey sign-in before the device is fully registered. validate against the user's device registration timeline. genuine whfb and passkey sign-ins are otherwise accompanied by a populated device identifier.

Techniques

Sample rules

Entra ID Windows Hello or Passkey Sign-in from Unregistered Device

Description

Identifies a Microsoft Entra ID sign-in that is satisfied by a phishing-resistant, device-bound credential (Windows Hello for Business, FIDO2 security key, or passkey) while carrying no device identifier. Windows Hello for Business (WHfB) and passkey credentials are bound to a device’s TPM, so a genuine sign-in with one of these methods is normally accompanied by the registered device it lives on. A WHfB or passkey assertion that authenticates with an empty device_detail.device_id indicates the underlying key material is being used away from its bound device, for example by an adversary who extracted the key (or signed an assertion with it) and replayed it from attacker infrastructure to mint device-agnostic tokens. This is the core primitive of the “borrowing Windows Hello keys” technique and is a strong precursor to attacker device registration and Primary Refresh Token (PRT) issuance. Cross-tenant (B2B) sign-ins are excluded because they are a common benign source of empty device identifiers.

Detection logic

data_stream.dataset: "azure.signinlogs" and
    event.category: "authentication" and
    azure.signinlogs.result_signature: "SUCCESS" and
    azure.signinlogs.properties.user_type: "Member" and
    azure.signinlogs.properties.authentication_details.authentication_method: (
        "Windows Hello for Business" or *passkey* or FIDO2* or *Passkey*
    ) and
    azure.signinlogs.properties.device_detail.device_id: ("" or not *) and
    azure.signinlogs.properties.cross_tenant_access_type: "none" and
    azure.signinlogs.properties.user_principal_name: *