Elastic high stable kql

Entra ID Conditional Access Policy (CAP) Modified

Identifies a modification to a conditional access policy (CAP) in Microsoft Entra ID. Adversaries may modify existing CAPs to loosen access controls and maintain persistence in the environment with a compromised identity or entity.

View Source

Detection Logic

data_stream.dataset: "azure.auditlogs"
    and event.action:"Update conditional access policy"
    and event.outcome: "success"

Field Validations

Loading…

Comments (0)

Loading comments...