Azure AD: Detect Removal From Group With Conditional Access Policy Modification Rights
Alerts when a user is removed from a group that can modify Conditional Access policies in Azure Entra.
- Product
- azure
- Service
- auditlogs
- Author
- Mark Morowczynski '@markmorow', Thomas Detzner '@tdetzner' (SigmaHQ), DRL 1.1
- Published
- 2022-08-04
- Updated
- 2026-07-31
ATT&CK techniques
Persistence → Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags audit events where a user is removed from a group, specifically targeting groups that have Conditional Access policy modification permissions. Attackers may remove users from privileged groups to disrupt security baselines, evade monitoring, or reduce access after misuse. It relies on Azure audit log messages indicating a “Remove member from group” action and applies no additional filtering beyond the matched message text.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Azure AD: Detect Removal From Group With Conditional Access Policy Modification Rights"
id: a67a055a-e098-4c74-bd03-2475632a8151
status: test
description: This rule flags audit events where a user is removed from a group, specifically targeting groups that have Conditional Access policy modification permissions. Attackers may remove users from privileged groups to disrupt security baselines, evade monitoring, or reduce access after misuse. It relies on Azure audit log messages indicating a “Remove member from group” action and applies no additional filtering beyond the matched message text.
references:
- https://learn.microsoft.com/en-us/entra/architecture/security-operations-infrastructure#conditional-access
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/audit_logs/azure_group_user_removal_ca_modification.yml
author: Mark Morowczynski '@markmorow', Thomas Detzner '@tdetzner', Huntrule Team
date: 2022-08-04
tags:
- attack.privilege-escalation
- attack.credential-access
- attack.persistence
- attack.defense-impairment
- attack.t1548
- attack.t1556
logsource:
product: azure
service: auditlogs
detection:
selection:
properties.message: Remove member from group
condition: selection
falsepositives:
- User removed from the group is approved
level: medium
license: DRL-1.1
related:
- id: 665e2d43-70dc-4ccc-9d27-026c9dd7ed9c
type: derived