Azure Entra: Added member to group granting Conditional Access policy modification
Alerts when a user is added to a group that can modify Conditional Access policies in Azure Entra ID.
- Product
- azure
- Service
- auditlogs
- Author
- Mark Morowczynski '@markmorow', Thomas Detzner '@tdetzner' (SigmaHQ), DRL 1.1
- Published
- 2022-08-04
- Updated
- 2026-07-31
ATT&CK techniques
Persistence → Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule alerts when audit logs show a user being added to a group via “Add member from group” where the group has Conditional Access policy modification capabilities. Granting CA policy modification access can enable attackers to weaken access controls, persist privileged access, or impair defenses. The detection relies on Azure audit log messages capturing group membership additions.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Azure Entra: Added member to group granting Conditional Access policy modification"
id: cc38f7e1-f201-44d8-b06a-6135c1b7a3e5
status: test
description: This rule alerts when audit logs show a user being added to a group via “Add member from group” where the group has Conditional Access policy modification capabilities. Granting CA policy modification access can enable attackers to weaken access controls, persist privileged access, or impair defenses. The detection relies on Azure audit log messages capturing group membership additions.
references:
- https://learn.microsoft.com/en-us/entra/architecture/security-operations-infrastructure#conditional-access
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/audit_logs/azure_group_user_addition_ca_modification.yml
author: Mark Morowczynski '@markmorow', Thomas Detzner '@tdetzner', Huntrule Team
date: 2022-08-04
tags:
- attack.privilege-escalation
- attack.credential-access
- attack.persistence
- attack.defense-impairment
- attack.t1548
- attack.t1556
logsource:
product: azure
service: auditlogs
detection:
selection:
properties.message: Add member from group
condition: selection
falsepositives:
- User removed from the group is approved
level: medium
license: DRL-1.1
related:
- id: 91c95675-1f27-46d0-bead-d1ae96b97cd3
type: derived