azure:auditlogs Update conditional access policy
Update conditional access policy
- Log source
- Entra ID audit logs
- Host type
- Azure (platform and Entra ID)
- Tier, host type
- Recommended
- Techniques
- 0
- Rules depending on it
- Microsoft Sentinel 6
Why this tier
By role
| Role | Tier | Basis |
|---|---|---|
| Azure and Entra ID tenant | Recommended |
Techniques it helps detect
No ATT&CK analytic names this event. Its standing comes from the standards and rules below.
Rules that depend on it
Microsoft Sentinel 6
- Conditional Access - A Conditional Access Device platforms condition has changed (the Device platforms condition can be spoofed)
- Conditional Access - A Conditional Access app exclusion has changed
- Conditional Access - A Conditional Access policy was disabled
- Conditional Access - A Conditional Access policy was put into report-only mode
- Conditional Access - A Conditional Access policy was updated
- Conditional Access - A Conditional Access user/group/role exclusion has changed