Okta Application Sign-On Policy Modified or Deleted

SigmaHQ Detections@sigmaHQ

•updated Nov 3, 2025•0•21

Detects when an Okta application Sign-on Policy is modified or deleted. This could indicate an adversary attempting to weaken security controls to gain unauthorized access or maintain persistence.