Conditional Access Policy Logs

Location

Description

Per-sign-in evaluation results of all Conditional Access policies showing which policies were applied, which were not matched, and whether the grant/session controls succeeded or failed.

Forensic Value

Conditional Access logs reveal exactly which security policies were evaluated during an attacker sign-in and why access was granted. If an attacker bypassed MFA, these logs show whether it was because no CA policy required MFA for that application, the policy excluded the user, or the device was considered compliant. This directly informs remediation by identifying policy gaps exploited during the incident.

Tools Required