Decoding UserAuthenticationMethod in Microsoft 365 audit logs: the bitfield mapping

This report documents Sekoia.io’s findings that Microsoft 365’s `UserAuthenticationMethod` is a bitfield representing primary-capable authentication methods and shows how to decode it by correlating Microsoft 365 audit logs with Microsoft Entra sign-in logs (e.g., mapping values like Password Hash Sync, staged rollout, and passkeys). It provides a correlation-based methodology, an investigation example using Sekoia Operating Language, and a real MFA flow demonstrating bit accumulation, while acknowledging unmapped bits and encouraging community validation and updates.