How to get an alert whenever a Conditional Access Policy is modified? (4377301)

Is it possible to create a search and alert whenever a Conditional Access Policy is changed or modified?

For conditional access changes, you will have to create a custom search with the Activity value "Update to conditional access policy" in the filter. You can then add any additional filters or parameters of your choice based on what is available in On Demand Audit (ODA).

As a reference, see in the example below the type of events that get logged in ODA whenever a conditional access policy is changed:

Click To See Full Image.

Test it out and after making sure it includes the expected events, enable this search as an alert as explained in the KB article below:

https://support.quest.com/kb/4373422