Azure Entra ID: Added User to Group Granted Conditional Access Policy Modification

Alerts when a user is added to a group that can modify Conditional Access policies in Azure Entra ID.

FreeUnreviewedSigmamediumv1

azure-entra-id-added-user-to-group-granted-conditional-access-policy-modificatio-91c95675

title: "Azure Entra ID: Added User to Group Granted Conditional Access Policy Modification"
id: cc38f7e1-f201-44d8-b06a-6135c1b7a3e5
status: test
description: This rule triggers when an audit log indicates a user was added as a member from a group (“Add member from group”) where the group has Conditional Access policy modification access. Such membership can allow an attacker to alter authentication and access controls, enabling privilege escalation, persistence, or defense-impairment. It relies on Azure audit log events captured under the Azure auditlogs source and matches the specific add-member operation message text.
references:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-infrastructure#conditional-access
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/audit_logs/azure_group_user_addition_ca_modification.yml
author: Mark Morowczynski '@markmorow', Thomas Detzner '@tdetzner', Huntrule Team
date: 2022-08-04
tags:
  - attack.privilege-escalation
  - attack.credential-access
  - attack.persistence
  - attack.defense-impairment
  - attack.t1548
  - attack.t1556
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    properties.message: Add member from group
  condition: selection
falsepositives:
  - User removed from the group is approved
level: medium
license: DRL-1.1
related:
  - id: 91c95675-1f27-46d0-bead-d1ae96b97cd3
    type: derived

What it detects

This rule triggers when an audit log indicates a user was added as a member from a group (“Add member from group”) where the group has Conditional Access policy modification access. Such membership can allow an attacker to alter authentication and access controls, enabling privilege escalation, persistence, or defense-impairment. It relies on Azure audit log events captured under the Azure auditlogs source and matches the specific add-member operation message text.

Known false positives

User removed from the group is approved

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.