Conditionalaccessreportonly

KQL detection rule by ep3p · MIT

Possible results: reportOnlyNotApplied, reportOnlyFailure, reportOnlySuccess

// Possible results: reportOnlyNotApplied, reportOnlyFailure, reportOnlySuccess
union
    (
    SigninLogs
    )
    // ,
    // (
    // AADNonInteractiveUserSignInLogs
    // | extend ConditionalAccessPolicies = todynamic(ConditionalAccessPolicies)
    // )
| mv-expand ConditionalAccessPolicy = ConditionalAccessPolicies
| extend
    DisplayName = tostring(ConditionalAccessPolicy["displayName"]),
    ConditionsNotSatisfied = toint(ConditionalAccessPolicy["conditionsNotSatisfied"]),
    ConditionsSatisfied = toint(ConditionalAccessPolicy["conditionsSatisfied"]),
    EnforcedGrantControls = tostring(ConditionalAccessPolicy["enforcedGrantControls"]),
    EnforcedSessionControls = tostring(ConditionalAccessPolicy["enforcedSessionControls"]),
    PolicyId = tostring(ConditionalAccessPolicy["id"]),
    PolicyResult = tostring(ConditionalAccessPolicy["result"])
| summarize
    Count_NotApplied = countif(PolicyResult == "reportOnlyNotApplied"),
    Count_Failure = countif(PolicyResult == "reportOnlyFailure"),
    Count_Success = countif(PolicyResult == "reportOnlySuccess"),
    DistinctUsers_NotApplied = dcountif(UserId, PolicyResult == "reportOnlyNotApplied"),
    DistinctUsers_Failure = dcountif(UserId, PolicyResult == "reportOnlyFailure"),
    DistinctUsers_Success = dcountif(UserId, PolicyResult == "reportOnlySuccess"),
    Example = take_any(ConditionalAccessPolicy),
    StartTime = min(TimeGenerated),
    EndTime = arg_max(TimeGenerated, DisplayName)
    by Type, PolicyId, EnforcedGrantControls, EnforcedSessionControls
| extend Count_Success = iff(EnforcedGrantControls == '["Block"]', int(null), Count_Success)
| extend DistinctUsers_Success = iff(EnforcedGrantControls == '["Block"]', int(null), DistinctUsers_Success)
| sort by DisplayName
| project-reorder DisplayName, Enforced*, Count_NotApplied, Count_Failure, Count_Success, DistinctUsers_NotApplied, DistinctUsers_Failure, DistinctUsers_Success, Example, PolicyId, StartTime, EndTime

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

8cd577b8-04e3-43f4-90f3-78e10ae69479

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion