Azure Entra Conditional Access Policy Deleted by Non-Approved Actor
Flags Azure audit log events where a conditional access policy is deleted.
FreeReviewedSigma · Medium · v5
- Product
- azure
- Service
- auditlogs
- Author
- Corissa Koopmans, '@corissalea' (SigmaHQ), DRL 1.1
- Published
- 2022-07-19
- Updated
- 2026-07-31
ATT&CK techniques
Persistence → Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags audit log events where a conditional access policy is deleted. Attackers can use conditional access policy removals to weaken authentication controls and maintain persistence by reducing enforcement. The detection relies on Azure audit log entries with a message indicating “Delete conditional access policy” and correlates the actor identity against an allowlist of approved identities.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
azure-ad-conditional-access-policy-deleted-by-non-approved-actor-26e7c5e2
title: Azure Entra Conditional Access Policy Deleted by Non-Approved Actor
id: b3599b3e-a198-4aeb-aedd-cd16e347df18
status: test
description: This rule flags audit log events where a conditional access policy is deleted. Attackers can use conditional access policy removals to weaken authentication controls and maintain persistence by reducing enforcement. The detection relies on Azure audit log entries with a message indicating “Delete conditional access policy” and correlates the actor identity against an allowlist of approved identities.
references:
- https://learn.microsoft.com/en-us/entra/architecture/security-operations-infrastructure#conditional-access
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/audit_logs/azure_aad_secops_ca_policy_removedby_bad_actor.yml
author: Corissa Koopmans, '@corissalea', Huntrule Team
date: 2022-07-19
tags:
- attack.privilege-escalation
- attack.credential-access
- attack.persistence
- attack.defense-impairment
- attack.t1548
- attack.t1556
logsource:
product: azure
service: auditlogs
detection:
selection:
properties.message: Delete conditional access policy
condition: selection
falsepositives:
- Misconfigured role permissions
- Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
level: medium
license: DRL-1.1
related:
- id: 26e7c5e2-6545-481e-b7e6-050143459635
type: derived