Entra Conditional Access Bypass — NAA / BroCI / FOCI
Detects non-interactive sign-in events using specific Microsoft application IDs (Intune for Education, Intune portal) to access Microsoft Graph that do not have a corresponding successful or failed Conditional Access policy record. This suggests potential circumvention of Conditional Access policies or service-level activity bypassing standard authentication auditing.
Microsoft Sentinel (KQL)
