Azure Sign-in Failure Blocked by Conditional Access Requirement Not Met

title: Azure Sign-in Failure Blocked by Conditional Access Requirement Not Met
id: 9f2c71b7-a70f-4c2c-808b-b68a43950bde
status: test
description: This rule flags Azure sign-in log events where the authentication result was blocked due to Conditional Access requirements not being met. Attackers often rely on repeated sign-in attempts and policy gaps to reach resources, so policy-enforced blocks are useful signals for investigation and tuning. The detection relies on Azure sign-in log telemetry fields indicating a Conditional Access block via ResultType and Resultdescription.
references:
  - https://learn.microsoft.com/en-gb/entra/architecture/security-operations-privileged-accounts
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/signin_logs/azure_conditional_access_failure.yml
author: Yochana Henderson, '@Yochana-H', Huntrule Team
date: 2022-06-01
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.initial-access
  - attack.credential-access
  - attack.stealth
  - attack.t1110
  - attack.t1078.004
logsource:
  product: azure
  service: signinlogs
detection:
  selection:
    ResultType: 53003
    Resultdescription: Blocked by Conditional Access
  condition: selection
falsepositives:
  - Service Account misconfigured
  - Misconfigured Systems
  - Vulnerability Scanners
level: high
license: DRL-1.1
related:
  - id: b4a6d707-9430-4f5f-af68-0337f52d5c42
    type: derived