Azure AD Conditional Access Policy Added by Non-approved Actor

Alerts on Azure audit log events indicating a Conditional Access policy was added.

FreeUnreviewedSigmamediumv1

azure-ad-conditional-access-policy-added-by-non-approved-actor-0922467f

title: Azure AD Conditional Access Policy Added by Non-approved Actor
id: 20199234-c0f3-470e-bec1-0ad8d3942cb9
status: test
description: This rule flags audit log events where a new Conditional Access policy is added. Attackers may use policy changes to weaken authentication controls or bypass sign-in protections, so new policy creation is a high-signal change. It relies on Azure audit log entries whose message indicates a Conditional Access policy was added.
references:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-infrastructure
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/audit_logs/azure_aad_secops_new_ca_policy_addedby_bad_actor.yml
author: Corissa Koopmans, '@corissalea', Huntrule Team
date: 2022-07-18
tags:
  - attack.privilege-escalation
  - attack.t1548
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    properties.message: Add conditional access policy
  condition: selection
falsepositives:
  - Misconfigured role permissions
  - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
level: medium
license: DRL-1.1
related:
  - id: 0922467f-db53-4348-b7bf-dee8d0d348c6
    type: derived

What it detects

This rule flags audit log events where a new Conditional Access policy is added. Attackers may use policy changes to weaken authentication controls or bypass sign-in protections, so new policy creation is a high-signal change. It relies on Azure audit log entries whose message indicates a Conditional Access policy was added.

Known false positives

Misconfigured role permissions
Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.