Okta: Sign-on Policy Update or Rule Deletion

title: "Okta: Sign-on Policy Update or Rule Deletion"
id: 80212993-ddc8-460a-872c-ade548e54851
status: test
description: This rule identifies Okta events where an application sign-on policy is updated or where a sign-on policy rule is deleted. Attackers may alter sign-in enforcement to weaken authentication requirements or disrupt access controls. It relies on Okta system log event types for sign-on policy updates and sign-on rule deletions.
references:
  - https://developer.okta.com/docs/reference/api/system-log/
  - https://developer.okta.com/docs/reference/api/event-types/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/identity/okta/okta_application_sign_on_policy_modified_or_deleted.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-09-12
modified: 2026-04-27
tags:
  - attack.impact
logsource:
  product: okta
  service: okta
detection:
  selection:
    eventType:
      - application.policy.sign_on.update
      - application.policy.sign_on.rule.delete
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 8f668cc4-c18e-45fe-ad00-624a981cf88a
    type: derived