Azure Entra: Added member to group granting Conditional Access policy modification

Alerts when a user is added to a group that can modify Conditional Access policies in Azure Entra ID.

FreeReviewedSigma · Medium · v5

Product: azure
Service: auditlogs
Author: Mark Morowczynski '@markmorow', Thomas Detzner '@tdetzner' (SigmaHQ), DRL 1.1
Published: 2022-08-04
Updated: 2026-07-31

ATT&CK techniques

Persistence → Cred Access

Recon
Resource Dev
Initial Access
Execution
Persistence
- T1556Modify Authentication Process
Priv Esc
- T1548Abuse Elevation Control Mechanism
Defense Evasion
- T1548Abuse Elevation Control Mechanism
- T1556Modify Authentication Process
Cred Access
- T1556Modify Authentication Process
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule alerts when audit logs show a user being added to a group via “Add member from group” where the group has Conditional Access policy modification capabilities. Granting CA policy modification access can enable attackers to weaken access controls, persist privileged access, or impair defenses. The detection relies on Azure audit log messages capturing group membership additions.

Reporting behind it

Related detections9 linkedT1548 — drag to rearrange

Azure AD: Detect Removal From Group With Conditional Access Policy Modification Rights

Azure Entra Conditional Access Policy Deleted by Non-Approved Actor

Azure Entra conditional access policy updated by non-approved actor

Suspicious User Home Directory Modification via dscl Process Creation

Possible GTFOBins Shell Breakout via apt Command

Suspicious XZ Utils Backdoor Kill-Switch Environment String via process_creation

Malicious Update Orchestrator Service Reconfiguration for Privilege Escalation

Suspicious AWS SAML Identity Provider Creation

Malicious macOS Credential Verification via dscl authonly

Azure Entra: Added member to group granting Conditional Access policy modification

Pivot detection · T1548 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

azure-entra-id-added-user-to-group-granted-conditional-access-policy-modificatio-91c95675

title: "Azure Entra: Added member to group granting Conditional Access policy modification"
id: cc38f7e1-f201-44d8-b06a-6135c1b7a3e5
status: test
description: This rule alerts when audit logs show a user being added to a group via “Add member from group” where the group has Conditional Access policy modification capabilities. Granting CA policy modification access can enable attackers to weaken access controls, persist privileged access, or impair defenses. The detection relies on Azure audit log messages capturing group membership additions.
references:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-infrastructure#conditional-access
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/audit_logs/azure_group_user_addition_ca_modification.yml
author: Mark Morowczynski '@markmorow', Thomas Detzner '@tdetzner', Huntrule Team
date: 2022-08-04
tags:
  - attack.privilege-escalation
  - attack.credential-access
  - attack.persistence
  - attack.defense-impairment
  - attack.t1548
  - attack.t1556
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    properties.message: Add member from group
  condition: selection
falsepositives:
  - User removed from the group is approved
level: medium
license: DRL-1.1
related:
  - id: 91c95675-1f27-46d0-bead-d1ae96b97cd3
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL