Azure Entra conditional access policy updated by non-approved actor
Alerts when an Azure Entra Conditional Access policy update occurs, indicating access control changes by an actor outside the approved set.
- Product
- azure
- Service
- auditlogs
- Author
- Corissa Koopmans, '@corissalea' (SigmaHQ), DRL 1.1
- Published
- 2022-07-19
- Updated
- 2026-07-31
ATT&CK techniques
Persistence → Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags audit events where the message indicates a conditional access policy update occurred. Unexpected changes to conditional access can allow attackers to weaken authentication controls, maintain persistence, or impair defenses. It relies on Azure audit log telemetry, specifically the presence of the event message indicating an update to a conditional access policy.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Azure Entra conditional access policy updated by non-approved actor
id: 33f3d5b6-c8c1-466e-8db1-ad1029b1110d
status: test
description: This rule flags audit events where the message indicates a conditional access policy update occurred. Unexpected changes to conditional access can allow attackers to weaken authentication controls, maintain persistence, or impair defenses. It relies on Azure audit log telemetry, specifically the presence of the event message indicating an update to a conditional access policy.
references:
- https://learn.microsoft.com/en-us/entra/architecture/security-operations-infrastructure#conditional-access
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/audit_logs/azure_aad_secops_ca_policy_updatedby_bad_actor.yml
author: Corissa Koopmans, '@corissalea', Huntrule Team
date: 2022-07-19
modified: 2024-05-28
tags:
- attack.privilege-escalation
- attack.credential-access
- attack.persistence
- attack.defense-impairment
- attack.t1548
- attack.t1556
logsource:
product: azure
service: auditlogs
detection:
selection:
properties.message: Update conditional access policy
condition: selection
falsepositives:
- Misconfigured role permissions
- Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
level: medium
license: DRL-1.1
related:
- id: 50a3c7aa-ec29-44a4-92c1-fce229eef6fc
type: derived