Most Popular 2026 Detection — Conditional Access Policy Exclusion Added for a Si
Detects modifications to Entra ID (Azure AD) Conditional Access policies where a user or group is explicitly added to an exclusion list. This behavior can be used by adversaries to bypass mandatory Multi-Factor Authentication (MFA) or device compliance requirements, facilitating persistence on a compromised account.
Sigma
