Analytics BIOC
Low
✕
Conditional Access policy removed
An identity removed a Conditional Access policy.
- Module:
- Identity Threat Detection (ITDR), SaaS Threat Detection
- Licensed by:
- Identity Threat Detection (ITDR)
- Data source:
- AzureAD Audit Log
ATT&CK tactics: Defense Evasion (TA0005)
ATT&CK techniques: Abuse Elevation Control Mechanism (T1548)
Attacker's goals:
An attacker attempts to change Active Directory configuration for persistence or defense evasion. Without a Conditional Access policy, an attacker would be able to access the tenant without possible blockage for later access.
Investigative actions:
Check implications of the policy being removed. Check whether the user changing the configuration is permitted to perform such actions.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Day