User Access Blocked by Azure Conditional Access

 1title: User Access Blocked by Azure Conditional Access
 2id: 9a60e676-26ac-44c3-814b-0c2a8b977adf
 3status: test
 4description: |
 5    Detect access has been blocked by Conditional Access policies.
 6    The access policy does not allow token issuance which might be sights≈ of unauthorizeed login to valid accounts.    
 7references:
 8    - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts
 9author: AlertIQ
10date: 2021-10-10
11modified: 2022-12-25
12tags:
13    - attack.credential-access
14    - attack.initial-access
15    - attack.t1110
16    - attack.t1078.004
17logsource:
18    product: azure
19    service: signinlogs
20detection:
21    selection:
22        ResultType: 53003
23    condition: selection
24falsepositives:
25    - Unknown
26level: medium

References

• Security operations for privileged accounts in Microsoft Entra ID - Microsoft Entra

  

  Learn about baselines, and how to monitor and alert on potential security issues with privileged accounts in Microsoft Entra ID.

  
  Read More

Related rules

• Failed Authentications From Countries You Do Not Operate Out Of
• Multifactor Authentication Denied
• Multifactor Authentication Interrupted
• Potential MFA Bypass Using Legacy Client Authentication
• Sign-in Failure Due to Conditional Access Requirements Not Met