Entra ID Named Location Created or Modified to Include IP Range
Detects the creation or modification of Named Locations within Conditional Access policies that include IP ranges. This behavior could indicate an attacker whitelisting their own IP addresses to maintain persistence or bypass Conditional Access security controls. The rule correlates changes with administrative context, such as non-standard business hours, weekends, or modifications by unexpected accounts.
Microsoft Sentinel (KQL)
