Detecting Conditional Access Policy Tampering (T1556.009)

Conditional access policies are the rules that decide whether a valid login should be accepted. MITRE ATT&CK technique T1556.009, Conditional Access Policies, covers adversaries who change those rules to keep access to compromised accounts. The tactics are defense impairment, persistence and credential access, and the platforms are IaaS and Identity Provider.

How attackers use it

Conditional access adds verification beyond the password. MITRE notes that in Entra ID, Okta and JumpCloud, users can be denied access to applications based on IP address, device enrollment status and use of multi-factor authentication, and some providers support risk based denial. In AWS and GCP, IAM policies can include condition attributes that check arbitrary constraints such as source IP, request date, and the resources or regions requested.

These controls keep stolen credentials from turning into data access. So adversaries edit them: adding trusted IP ranges, removing MFA requirements, or allowing additional unused or unsupported cloud regions (T1535). Each change makes the compromised account easier to use and harder to challenge.

How to detect it

MITRE lists no data sources here. The relevant records are your identity provider and cloud audit logs:

• Policy create, update and delete events in Entra ID, Okta or JumpCloud, and policy changes in AWS IAM and GCP.
• New entries in trusted location or named IP lists.
• Removed or loosened MFA grant controls.
• Exclusion lists that gained members.
• Newly allowed regions or conditions that were deleted from a policy.

Alert on every one of these. Policy edits are rare in a healthy tenant, so each one deserves a human check against a change ticket.

How to reduce the risk

MITRE lists one mitigation, user account management: limit permissions to modify conditional access policies to only those required. Keep the group small, require privileged access elevation for edits, and export policies on a schedule so you can compare against the last known good copy.

Quick check

Sources

• MITRE ATT&CK T1556.009 Conditional Access Policies