User Added to Group with Conditional Access Policy Modification Access

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•27

This rule detects when a user is added to a group that has permissions to modify Conditional Access (CA) policies within Azure Active Directory. Such an action could indicate an attempt to escalate privileges, bypass existing security controls, or establish persistence by altering authentication processes.