We saw a successful sign-in (interactive) using ADIbizaUX application

Gerald Madla 0 Reputation points

I understand that ADIbizaUX is part of Microsoft Graph and Sync. However, what does it signify if there is a successful interactive sign-in using the ADIbizaUX application?

Does this indicate that our user might have been compromised?

Why does this occurrence only affect certain users randomly?

Reference ;


Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
20,079 questions
0 comments No comments
{count} votes

1 answer

Sort by: Most helpful
  1. Raja Pothuraju 300 Reputation points Microsoft Vendor

    Hello @Gerald Madla,

    Thank you for posting your query on Microsoft Q&A.

    Yes, ADIbizaUX is indeed a part of Microsoft Graph and Sync, as explained in the following Q&A: link.

    Based on your statement, I understand that you're encountering successful sign-in logs related to ADIbizaUX, and you wish to determine if this is expected behavior or if it indicates a potential compromise of the user's account.

    This behavior is expected. When users log into the Azure Portal, interactions with ADIbizaUX logs are triggered due to backend resources. However, to ensure security, I recommend verifying the post-sign-in logs of the user to check for any other potentially suspicious activity beyond interactions with the ADIbizaUX application.

    Please refer to the screenshot from my test tenant, where a user signed into the Azure Portal, triggering the ADIbizaUX application in the interactive sign-in log.image

    Reference: https://learn.microsoft.com/en-us/troubleshoot/azure/entra/entra-id/governance/verify-first-party-apps-sign-in#application-ids-of-commonly-used-microsoft-applications

    I hope this information is helpful. Please feel free to reach out if you have any further questions.


    Raja Pothuraju.

    If this answers your query, do click **Accept Answer** and **Yes** for was this answer helpful. And, if you have any further query do let us know.