Need Clarification on "Update user" operation in Audit Log

[Vel]

Hello Sentinel Community,

I recently came across an event in my Azure Sentinel instance that I'm seeking clarification on. The event shows an operation labeled "Update user" and the display name as "StrongAuthenticationPhoneAppDetail identified by Azure MFA StrongAuthenticationService."

Could someone please help me understand what this event signifies and what type of activity the end user might have performed? Specifically, I'm curious about the implications of the "Update user" operation and how it relates to Azure Multi-Factor Authentication (MFA) settings.

Any insights or guidance on where to find more information would be greatly appreciated.

[#2]

I'm pretty sure that StrongAuthenticationPhoneAppDetail holds the phone details for MFA, so you are seeing the user updating something like their phone number / setting etc...

https://answers.microsoft.com/en-us/msoffice/forum/all/powershell-to-see-what-device-mfa-is-register...