Microsoft Graph API Conditional Access Policy Modification
Detects attempts to modify or delete Microsoft Graph API conditional access policies. This could indicate an adversary attempting to weaken security controls to facilitate unauthorized access or persistence.
Microsoft Sentinel (KQL)
