2026 Critical Cloud Control Plane Detection: Azure Conditional Access Policy Weakened or MFA Disabled
Detects modifications or deletions of Azure AD Conditional Access policies that weaken security, such as disabling policies, removing MFA requirements, or adding user/group/application exclusions. This behavior can be indicative of an attacker attempting to bypass authentication controls.
Cortex XDR
