Azure Conditional Access Policy Updated by Non-Approved Actor

Alerts when an Azure Entra Conditional Access policy update occurs, indicating access control changes by an actor outside the approved set.

FreeUnreviewedSigmamediumv1

azure-conditional-access-policy-updated-by-non-approved-actor-50a3c7aa

title: Azure Conditional Access Policy Updated by Non-Approved Actor
id: 33f3d5b6-c8c1-466e-8db1-ad1029b1110d
status: test
description: This rule flags audit log events where a conditional access policy update is performed. It focuses on changes to access control that can be used by an attacker to maintain persistence, impair defenses, or enable credential access. The detection relies on Azure audit log telemetry matching the message "Update conditional access policy" and is intended to be evaluated against an approved-actor allowlist by comparing identities and modified properties over time.
references:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-infrastructure#conditional-access
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/audit_logs/azure_aad_secops_ca_policy_updatedby_bad_actor.yml
author: Corissa Koopmans, '@corissalea', Huntrule Team
date: 2022-07-19
modified: 2024-05-28
tags:
  - attack.privilege-escalation
  - attack.credential-access
  - attack.persistence
  - attack.defense-impairment
  - attack.t1548
  - attack.t1556
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    properties.message: Update conditional access policy
  condition: selection
falsepositives:
  - Misconfigured role permissions
  - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
level: medium
license: DRL-1.1
related:
  - id: 50a3c7aa-ec29-44a4-92c1-fce229eef6fc
    type: derived

What it detects

This rule flags audit log events where a conditional access policy update is performed. It focuses on changes to access control that can be used by an attacker to maintain persistence, impair defenses, or enable credential access. The detection relies on Azure audit log telemetry matching the message "Update conditional access policy" and is intended to be evaluated against an approved-actor allowlist by comparing identities and modified properties over time.

Known false positives

Misconfigured role permissions
Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.