Azure AD Conditional Access Policy Tampering via AuditLogs

Ankit Mehta@Secvyn

•updated Jun 30, 2026•2•0•2

Detects updates or deletions of Azure Active Directory (Entra ID) Conditional Access policies that occur outside of typical business hours (Monday-Friday 08:00-18:00 UTC). Such modifications can be an indicator of an adversary attempting to circumvent security controls or maintain persistent, unauthorized access.