You should address the unverified custom domains listed in the findings from this Indicator of Exposure, as they could be, or facilitate, a potential backdoor from an attacker.

To view the list of domains in the Azure portal, navigate to the Custom domain names blade and look for domains marked as 'Unverified' in the 'Status' column. Any potentially malicious domain will match the name listed in the findings. PowerShell cmdlets from MS Graph API allow you to list the domains with Get-MgDomain:

Connect-MgGraph -Scopes "Domain.Read.All"
Get-MgDomain -All | ? { $_.IsVerified -eq $True }

Complete the configuration of those unverified domains or remove them.

If it is a legitimate trusted domain, you need to create the required DNS entries with your domain registrar and then complete the verification process.

Otherwise, conduct a forensic investigation to determine if the domain was compromised and to assess the extent of the breach. Since adding a custom domain typically requires elevated privileges, such as the 'Global Administrator' role and potentially other lesser-known Entra roles, a full compromise of Entra ID is likely if these privileges are misused.

After saving evidence for potential forensic analysis, if you deem the domain to be illegitimate, remove it using Remove-MgDomain. Finally, anticipate that the attacker may have established other persistence mechanisms, such as backdoors. Consult with incident response experts to identify and eliminate these additional threats.

Detections

Analytics

Indicators of Exposure

LOW