Azure Sign-in Blocked by Conditional Access Policy (Token Issuance Denied)

title: Azure Sign-in Blocked by Conditional Access Policy (Token Issuance Denied)
id: 7b826530-134c-4ec0-8d5f-7351d0a23946
status: test
description: This rule flags Azure AD sign-in attempts where Conditional Access blocked the session because the policy did not allow token issuance (ResultType 53003). Attackers may trigger this when attempting to authenticate but fail conditional requirements, or when attempting to obtain tokens for access. The detection relies on Azure sign-in log telemetry, specifically the ResultType value in sign-in events.
references:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/signin_logs/azure_user_login_blocked_by_conditional_access.yml
author: AlertIQ, Huntrule Team
date: 2021-10-10
modified: 2022-12-25
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.credential-access
  - attack.initial-access
  - attack.stealth
  - attack.t1110
  - attack.t1078.004
logsource:
  product: azure
  service: signinlogs
detection:
  selection:
    ResultType: 53003
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 9a60e676-26ac-44c3-814b-0c2a8b977adf
    type: derived