diff --git a/rules/integrations/azure/initial_access_entra_id_oauth_device_code_phishing_tycoon_aitm.toml b/rules/integrations/azure/initial_access_entra_id_oauth_device_code_phishing_tycoon_aitm.toml
index 342b9c5c5f1..971df3504b5 100644
--- a/rules/integrations/azure/initial_access_entra_id_oauth_device_code_phishing_tycoon_aitm.toml
+++ b/rules/integrations/azure/initial_access_entra_id_oauth_device_code_phishing_tycoon_aitm.toml
@@ -2,7 +2,7 @@
 creation_date = "2026/05/15"
 integration = ["azure"]
 maturity = "production"
-updated_date = "2026/05/15"
+updated_date = "2026/06/20"
 
 [rule]
 author = ["Elastic"]
@@ -76,7 +76,7 @@ azure.signinlogs.properties.authentication_protocol:deviceCode and
 azure.signinlogs.properties.resource_id:(
     "00000002-0000-0ff1-ce00-000000000000" or
     "00000003-0000-0ff1-ce00-000000000000" or
-    "00000005-0000-0ff1-ce00-000000000000"
+    "00000003-0000-0000-c000-000000000000"
 ) and azure.signinlogs.properties.is_interactive:true
 '''