Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Conditional Access - A new Conditional Access policy was created

Back
Id0459a1b5-909d-4783-9e27-24536b05a47f
RulenameConditional Access - A new Conditional Access policy was created
DescriptionA new Conditional Access policy was created in Entra ID.
SeverityInformational
TacticsDefenseEvasion
TechniquesT1562.007
Required data connectorsAzureActiveDirectory
KindScheduled
Query frequency5m
Query period5m
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft Entra ID/Analytic Rules/Conditional Access - A new Conditional Access policy was created.yaml
Version1.0.0
Arm template0459a1b5-909d-4783-9e27-24536b05a47f.json
Deploy To Azure
// A new Conditional Access policy was created.
AuditLogs
| where OperationName in ("Add conditional access policy")
| extend modifiedBy = tostring(InitiatedBy.user.userPrincipalName)
| extend accountName = tostring(split(modifiedBy, "@")[0])
| extend upnSuffix = tostring(split(modifiedBy, "@")[1])
| project
    TimeGenerated,
    OperationName,
    policy = TargetResources[0].displayName,
    modifiedBy,
    accountName,
    upnSuffix,
    result = Result,
    newPolicy = TargetResources[0].modifiedProperties[0].newValue
| order by TimeGenerated desc
queryPeriod: 5m
eventGroupingSettings:
  aggregationKind: AlertPerResult
name: Conditional Access - A new Conditional Access policy was created
description: A new Conditional Access policy was created in Entra ID.
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft Entra ID/Analytic Rules/Conditional Access - A new Conditional Access policy was created.yaml
suppressionEnabled: false
requiredDataConnectors:
- dataTypes:
  - AuditLogs
  connectorId: AzureActiveDirectory
kind: Scheduled
id: 0459a1b5-909d-4783-9e27-24536b05a47f
version: 1.0.0
triggerOperator: gt
triggerThreshold: 0
query: |
  // A new Conditional Access policy was created.
  AuditLogs
  | where OperationName in ("Add conditional access policy")
  | extend modifiedBy = tostring(InitiatedBy.user.userPrincipalName)
  | extend accountName = tostring(split(modifiedBy, "@")[0])
  | extend upnSuffix = tostring(split(modifiedBy, "@")[1])
  | project
      TimeGenerated,
      OperationName,
      policy = TargetResources[0].displayName,
      modifiedBy,
      accountName,
      upnSuffix,
      result = Result,
      newPolicy = TargetResources[0].modifiedProperties[0].newValue
  | order by TimeGenerated desc  
suppressionDuration: 5h
incidentConfiguration:
  groupingConfiguration:
    lookbackDuration: 1h
    enabled: false
    matchingMethod: AllEntities
    groupByCustomDetails: []
    reopenClosedIncident: false
    groupByAlertDetails: []
    groupByEntities: []
  createIncident: true
entityMappings:
- fieldMappings:
  - identifier: Name
    columnName: accountName
  - identifier: UPNSuffix
    columnName: upnSuffix
  entityType: Account
tactics:
- DefenseEvasion
relevantTechniques:
- T1562.007
queryFrequency: 5m
severity: Informational
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/0459a1b5-909d-4783-9e27-24536b05a47f')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/0459a1b5-909d-4783-9e27-24536b05a47f')]",
      "properties": {
        "alertRuleTemplateName": "0459a1b5-909d-4783-9e27-24536b05a47f",
        "customDetails": null,
        "description": "A new Conditional Access policy was created in Entra ID.",
        "displayName": "Conditional Access - A new Conditional Access policy was created",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "accountName",
                "identifier": "Name"
              },
              {
                "columnName": "upnSuffix",
                "identifier": "UPNSuffix"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": false,
            "groupByAlertDetails": [],
            "groupByCustomDetails": [],
            "groupByEntities": [],
            "lookbackDuration": "PT1H",
            "matchingMethod": "AllEntities",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft Entra ID/Analytic Rules/Conditional Access - A new Conditional Access policy was created.yaml",
        "query": "// A new Conditional Access policy was created.\nAuditLogs\n| where OperationName in (\"Add conditional access policy\")\n| extend modifiedBy = tostring(InitiatedBy.user.userPrincipalName)\n| extend accountName = tostring(split(modifiedBy, \"@\")[0])\n| extend upnSuffix = tostring(split(modifiedBy, \"@\")[1])\n| project\n    TimeGenerated,\n    OperationName,\n    policy = TargetResources[0].displayName,\n    modifiedBy,\n    accountName,\n    upnSuffix,\n    result = Result,\n    newPolicy = TargetResources[0].modifiedProperties[0].newValue\n| order by TimeGenerated desc\n",
        "queryFrequency": "PT5M",
        "queryPeriod": "PT5M",
        "severity": "Informational",
        "subTechniques": [
          "T1562.007"
        ],
        "suppressionDuration": "PT5H",
        "suppressionEnabled": false,
        "tactics": [
          "DefenseEvasion"
        ],
        "techniques": [
          "T1562"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}