User Access Blocked by Azure Conditional Access Policy
Detects when user access has been blocked by Azure Conditional Access policies. This indicates that token issuance was denied, which could be a sign of unauthorized login attempts to valid accounts.
Sigma
