MFA Bypass via Conditional Access Policy Bypass
This rule detects potential MFA bypass attempts by identifying multiple successful sign-ins from the same user within an hour where Conditional Access policies were not applied, and no MFA method was used. This could indicate an adversary circumventing security controls to gain unauthorized access.
Microsoft Sentinel (KQL)
