Forum Discussion

Vel's avatar
Vel
Copper Contributor
Apr 18, 2024

Need Clarification on "Update user" operation in Audit Log

Hello Sentinel Community,

I recently came across an event in my Azure Sentinel instance that I'm seeking clarification on. The event shows an operation labeled "Update user" and the display name as "StrongAuthenticationPhoneAppDetail identified by Azure MFA StrongAuthenticationService."

Could someone please help me understand what this event signifies and what type of activity the end user might have performed? Specifically, I'm curious about the implications of the "Update user" operation and how it relates to Azure Multi-Factor Authentication (MFA) settings.

Any insights or guidance on where to find more information would be greatly appreciated.

 

 

Resources