User Removed From Group With CA Policy Modification Access
This rule detects when a user is removed from a group that has Conditional Access (CA) policy modification access within Azure Active Directory. Such groups are critical for managing access to resources, and unauthorized removal of members could indicate an attempt to evade detection, disrupt security controls, or prepare for further malicious activity. Monitoring these removals helps identify potential privilege escalation, defense evasion, or persistence attempts.
Sigma
