O365 External Identity Policy Changed

This analytic identifies when changes are made to the external guest policies within Azure AD. Specifically, it looks for the "Update policy." operation targeting "B2BManagementPolicy" in the Office 365 Universal Audit Log. The rule extracts and highlights the specific changes made to allowed/blocked domains for B2B collaboration, indicating whether domains were added or removed. Monitoring these changes is crucial as modifications to external identity policies can impact unauthorized access, as described in the BlackHat 2022 talk "Backdooring and Hijacking Azure AD Accounts by Abusing External Identities."