Microsoft 365 conditional access change
A Microsoft Entra Conditional Access policy (or strong-authentication / security-defaults setting) was created, changed, removed, or disabled.
What it detects
A Microsoft Entra Conditional Access policy (or strong-authentication / security-defaults setting) was created, changed, removed, or disabled. Weakening Conditional Access — excluding an account from MFA, disabling a policy, or turning off security defaults — is how an attacker with admin access keeps a foothold and evades identity controls.
MITRE ATT&CK mapping
False positives and triage
Identity admins tune Conditional Access legitimately. The signal is a change outside a change window, by an unexpected or recently compromised admin, or one that WEAKENS controls (excludes users from MFA, disables a policy). Review the policy diff and the actor.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 70%. Source: rules/cloud/m365_conditional_access_change.yaml, licensed under the Apache License 2.0.
id: cloud.identity.m365_conditional_access_change
version: 1.0.0
status: stable
severity: high
confidence: 0.7
platforms: [application]
mitre_techniques: [T1556, T1562.007]
description: |
A Microsoft Entra Conditional Access policy (or strong-authentication /
security-defaults setting) was created, changed, removed, or disabled.
Weakening Conditional Access — excluding an account from MFA, disabling a
policy, or turning off security defaults — is how an attacker with admin access
keeps a foothold and evades identity controls.
match:
provider: Office365
event_action_any:
- "New-ConditionalAccessPolicy"
- "Set-ConditionalAccessPolicy"
- "Remove-ConditionalAccessPolicy"
- "Add conditional access policy."
- "Update conditional access policy."
- "Delete conditional access policy."
- "Disable Strong Authentication."
- "Set-AzureADMSConditionalAccessPolicy"
correlation_keys: [user_name]
false_positive_guidance: |
Identity admins tune Conditional Access legitimately. The signal is a change
outside a change window, by an unexpected or recently compromised admin, or one
that WEAKENS controls (excludes users from MFA, disables a policy). Review the
policy diff and the actor.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.