Azure Conditional Access Policy Updated
This rule detects when a Conditional Access policy is updated within an Azure environment. It aims to identify unauthorized or suspicious modifications to these critical security policies, which could lead to privilege escalation, credential access, or defense evasion. The rule specifically looks for the message 'Update conditional access policy' in audit logs. Further investigation would involve checking if the actor initiating the change is approved and comparing the old versus new policy values.
Sigma
