Azure Conditional Access Policy Added by Non-approved Actor
Alerts on Azure audit log events indicating a Conditional Access policy was added.
- Product
- azure
- Service
- auditlogs
- Author
- Corissa Koopmans, '@corissalea' (SigmaHQ), DRL 1.1
- Published
- 2022-07-18
- Updated
- 2026-07-31
ATT&CK techniques
Priv Esc → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule alerts when a conditional access policy is added, based on the audit message text matching “Add conditional access policy.” Creating or modifying conditional access policies can be used to weaken or bypass authentication controls, enabling further privilege escalation. Detection relies on Azure audit log records that include the specific policy-add message and associates it with the acting identity for investigation.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Azure Conditional Access Policy Added by Non-approved Actor
id: 20199234-c0f3-470e-bec1-0ad8d3942cb9
status: test
description: This rule alerts when a conditional access policy is added, based on the audit message text matching “Add conditional access policy.” Creating or modifying conditional access policies can be used to weaken or bypass authentication controls, enabling further privilege escalation. Detection relies on Azure audit log records that include the specific policy-add message and associates it with the acting identity for investigation.
references:
- https://learn.microsoft.com/en-us/entra/architecture/security-operations-infrastructure
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/audit_logs/azure_aad_secops_new_ca_policy_addedby_bad_actor.yml
author: Corissa Koopmans, '@corissalea', Huntrule Team
date: 2022-07-18
tags:
- attack.privilege-escalation
- attack.t1548
logsource:
product: azure
service: auditlogs
detection:
selection:
properties.message: Add conditional access policy
condition: selection
falsepositives:
- Misconfigured role permissions
- Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
level: medium
license: DRL-1.1
related:
- id: 0922467f-db53-4348-b7bf-dee8d0d348c6
type: derived