Detection KQL queries to detect deletion, modification and creation of Conditional Access policies.
Detects when a new Conditional Access policy is created. Adds a RiskFlag that automatically highlights if the policy was created by an app or service principal (no UPN) rather than a human.
Detects when an existing Conditional Access policy is changed. Uses mv-expand to unpack every individual field that changed, giving you a proper before/after diff with OldValue and NewValue per row. Also auto-flags 🔴 High-Impact Field Changed when critical fields like state, conditions, or grantControls are touched.
Detects when a Conditional Access policy is soft deleted. Adds a RiskFlag that automatically highlights if the deletion was performed by an app or service principal (no UPN) rather than a human.
- Microsoft Entra ID P1
- Log Analytics Workspace with
AuditLogsstreaming enabled - Azure Monitor alert rule per query
- Action Group with Email / SMS ot both
For more info how to setup visit: https://www.need4.cloud/post/monitoring-conditional-access-policies-in-entra