Detects Microsoft Entra ID sign-ins that use phishing-resistant, device-bound credentials (Windows Hello for Business, FIDO2 security keys, or passkeys) with an empty device_id. WHfB and passkeys are bound to a device TPM; a sign-in with an empty device_detail.device_id signals the key material is being used away from its bound device, potentially replayed from attacker infrastructure to mint device-agnostic tokens. This signals the core ‘borrowing Windows Hello keys’ technique and can precede device registration and Primary Refresh Token (PRT) issuance. Cross-tenant sign-ins are excluded to reduce benign noise. The rule leverages Azure Entra ID Sign-In Logs to detect scenarios where authentication_method is WHfB/FIDO2/Passkey and device_id is missing. It maps to MITRE techniques for Defense Evasion (T1550: Use Alternate Authentication Material) and Initial Access (T1078: Valid Accounts, including Cloud Accounts). The rule includes a thorough triage path, false-positive guidance tied to onboarding, and remediation steps such as credential deletion, device revocation, and re-enrollment on a trusted device, plus guidance to enforce device compliance for sensitive resources. Triage and analysis, investigation steps, false positive considerations, and remediation guidance are provided within the rule’s note section to aid responders in validating and mitigating this signal.