Analytics BIOC
Informational
✕
Unusual Conditional Access operation for an identity
An identity attempted to add or update an Azure AD Conditional Access policy.
- Module:
- Identity Threat Detection (ITDR), SaaS Threat Detection
- Licensed by:
- Identity Threat Detection (ITDR)
- Data source:
- AzureAD Audit Log
ATT&CK tactics: Defense Evasion (TA0005)
ATT&CK techniques: Abuse Elevation Control Mechanism (T1548)
Attacker's goals:
An attacker attempts to change Active Directory configuration for persistence or defense evasion. With a modified Conditional Access policy, an attacker might be able to access the tenant without possible blockage for later access.
Investigative actions:
Check implications of the updated policy. Check whether the user changing the configuration is permitted to perform such actions.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Day
1 variation:
- Suspicious Conditional Access operation for an identity Low (parent: Informational)