Conditional Access policy edited shortly after rogue EAM/app registration

Ibrahim Saud@tektrix

•updated Sep 23, 2026•0•0•1

Detects a suspicious correlation between the registration of new authentication methods or application integrations and the subsequent modification of Conditional Access policies within a 2-hour window. This behavior is indicative of the activation phase of a TrustSink attack, where an adversary sets up a malicious MFA provider and forces its use by expanding Conditional Access policy scope.