Entra ID named location deleted or modified

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Content Index

---

Identifies deletions or modifications to named locations in Entra ID, which may indicate an attacker weakening Conditional Access enforcement by removing trusted network definitions.

Attribute	Value
Type	Hunting Query
Solution	Standalone Content
ID	ef54a29b-136c-42a3-9d37-49fd67e2598b
Tactics	DefenseEvasion
Techniques	T1562.001
Required Connectors	AzureActiveDirectory
Source	[View on GitHub](https://github.com/Azure/Azure-Sentinel/blob/master/Hunting Queries/AuditLogs/NamedLocationDeletedOrModified.yaml)

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Hunting Queries