Conditional Access Policy Weakened or Deleted in Entra ID
Detects modifications to Microsoft Entra ID (Azure AD) Conditional Access policies that weaken security controls, such as disabling policies, adding exclusions, or removing MFA and compliant device requirements. The rule also alerts on deletions of Conditional Access policies and modifications occurring outside of standard business hours.
Microsoft Sentinel (KQL)
