Detect Conditional Access Policies Operations
The detection looks for unauthorized or suspicious changes to the policies that control who can access your cloud resources and under what conditions. Correlate this change data with other signals, like a subsequent spike in risky sign-ins from a newly permitted location, to confirm a potential attack sequence as outlined in MITRE's analytics.
Microsoft Sentinel (KQL)
