Identifies a first-seen Windows Hello for Business (WHfB) credential registration for a Microsoft Entra ID user, observed via Azure Entra ID Audit Logs within a prefixed 14-day history window. The rule is a new_terms signal triggered when a tenant/user/source ASN combination is observed for the first time in the historical window, under the operation Add Windows Hello for Business credential with a successful outcome. While WHfB enrollment is commonly legitimate during onboarding or passwordless rollout, adversaries can leverage enrollment to establish durable, phishing-resistant persistence after compromising an MFA token or related credential (e.g., borrowing a WHfB key or passkey). The detector correlates the first-seen enrollment with preceding sign-ins and device state to assess whether the enrollment aligns with expected onboarding activity or represents suspicious behavior, such as a new ASN appearing for an established user. The query inspects azure.auditlogs for the addition event, filters by tenant, captures the initiator (initiated_by.user.userPrincipalName) and the source ASN (source.as.number), and relies on a 14-day history window to suppress legitimate enrollments that occur during normal onboarding. It emphasizes that a genuine enrollment from a known ASN or during scheduled rollout should not repeatedly fire within 14 days. The rule is designed to surface suspicious enrollments that warrant investigation, including cross-referencing with prior sign-in activity, device registrations, and token issuance events.