↳ GitHub sourceAnalytics ruleInformational

Conditional Access - A Conditional Access policy was updated

View on GitHub ↗Original file ↗

Description

A Conditional Access policy was updated in Entra ID.

Rule type: Scheduled
Version: 1.0.1
Query frequency: 5m
Query period: 5m
Trigger: gt 0

Declared MITRE coverage

DefenseEvasion T1562

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

AzureActiveDirectory

Data types

AuditLogs

KQL query

Original query, unchanged.

// A Conditional Access policy was updated.
AuditLogs
| where OperationName == "Update conditional access policy"
| extend
    policy = tostring(TargetResources[0].displayName),
    modifiedBy = tostring(InitiatedBy.user.userPrincipalName),
    oldPolicy = tostring(TargetResources[0].modifiedProperties[0].oldValue),
    newPolicy = tostring(TargetResources[0].modifiedProperties[0].newValue)
| extend
    accountName = tostring(split(modifiedBy, "@")[0]),
    upnSuffix = tostring(split(modifiedBy, "@")[1])
| project
    TimeGenerated,
    OperationName,
    policy,
    modifiedBy,
    accountName,
    upnSuffix,
    oldPolicy,
    newPolicy,
    Result

Declared entities

Account

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

File: Solutions/Microsoft Entra ID/Analytic Rules/Conditional Access - A Conditional Access policy was updated.yaml ↗
Commit: 9800e51 ↗
Source identifier: ccca6b88-a7b6-41c9-9be2-fc3daeb65b26

Additional source files 2

Solutions/Microsoft Entra ID/Analytic Rules/Conditional Access - A Conditional Access policy was updated.yamlsource ↗Solutions/Microsoft Entra ID/Data/Solution_AAD.jsonsolution-membership ↗

GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.