Conditional Access Policy Modification or Deletion via Microsoft Graph API
This rule detects attempts to modify or delete Conditional Access Policies within Microsoft Azure Active Directory (now Microsoft Entra ID) via the Microsoft Graph API. Adversaries may alter or remove these policies to bypass security controls, maintain persistence, or facilitate unauthorized access to resources. The detection specifically looks for network events targeting 'graph.microsoft.com' that involve 'conditionalAccessPolicies' and use 'PATCH' (modification) or 'DELETE' (removal) HTTP methods.
Microsoft Sentinel (KQL)
