You are reviewing Azure Activity Logs after a lab compromise. Which operation indicates that an attacker reset another user’s password through…

Detailed Solution:

In an Entra ID abuse path, a privileged user such as User Administrator may reset another user’s

password. In logs, this appears as a user update operation involving the password profile.

Check audit logs in the portal:

Microsoft Entra ID → Monitoring → Audit logs

Or query via Microsoft Graph/Azure tooling depending on permissions.

The activity to look for is generally:

Update user

Modified property: passwordProfile

The other options represent different activities:

Microsoft.Authorization/roleAssignments/write

= RBAC role assignment change

Microsoft.Storage/storageAccounts/listKeys/action = storage account key retrieval

Microsoft.KeyVault/vaults/secrets/read

= Key Vault secret read

Correct answer:

B. Update user / password profile modification

Thank you for your visit.