Suspicious Conditional Access Modifications
This detection rule flags events where conditional access policies are getting weaker, when modifications to CA inclusion or exclusion groups are happening, or when the effectiveness of a policy is disabled.
Microsoft Sentinel (KQL)
