Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,157 questions
What is the application "Office 365 Management" (AppId 00b41c95-dab0-4487-9791-b9d2c32c80f2) and why is Conditional Access not applied to it?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(124.80000000000001, 33%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ETS%3C/text%3E%3C/svg%3E)
Tilman Schmidt
0
Reputation points
I am investigating a security incident and I have identified entries in the MS Sentinel SigninLogs table that might be related to the breach with the attributes:
AppDisplayName: Office 365 Management
AppId: 00b41c95-dab0-4487-9791-b9d2c32c80f2
AuthenticationRequirement: singleFactorAuthentication
ConditionalAccessStatus: notApplied
ResultType: 0
We have enabled mandatory multi-factor authentication for all our users via conditional access policy, and I am concerned very much that there is apparently a way to bypass this.
What is this application "Office 365 Management"?
Why is my conditional access policy not applied to it?
What could an attacker do with it?
Can she just use it to check whether her stolen credentials are working or can she actually do harm beyond that?
Sign in to answer