Audit Entra Application Management Modifications to Password restrictions

"Add Policy" for new policies

Detection Query

AuditLogs
| where OperationName == "Update policy" //"Add Policy" for new policies
| where TargetResources[0].displayName == "ApplicationManagementPolicy"
| mv-expand TargetResources
| mv-expand ModifiedProperties = TargetResources.modifiedProperties
| where ModifiedProperties.displayName == "PolicyDetail"
| extend NewPolicy = parse_json(tostring(parse_json(tostring(ModifiedProperties.newValue))[0]))
| extend OldPolicy = parse_json(tostring(parse_json(tostring(ModifiedProperties.oldValue))[0]))
| extend NewPwd = parse_json(
        tostring(
            parse_json(tostring(NewPolicy.ServicePrincipalRestrictions)).PasswordCredentials
        ))
| extend OldPwd = parse_json(
        tostring(
            parse_json(tostring(OldPolicy.ServicePrincipalRestrictions)).PasswordCredentials
        ))
| where tostring(NewPwd.PasswordAddition.State) != tostring(OldPwd.PasswordAddition.State)
    or tostring(NewPwd.CustomPasswordAddition.State) != tostring(OldPwd.CustomPasswordAddition.State)
    or tostring(NewPwd.SymmetricKeyAddition.State) != tostring(OldPwd.SymmetricKeyAddition.State)
| project
    TimeGenerated,
    OldPasswordAddition = tostring(OldPwd.PasswordAddition.State),
    NewPasswordAddition = tostring(NewPwd.PasswordAddition.State),
    OldCustomPasswordAddition = tostring(OldPwd.CustomPasswordAddition.State), //1 = Custom Passwords blocked.
    NewCustomPasswordAddition = tostring(NewPwd.CustomPasswordAddition.State), // 2 = off, 1 = on
    OldSymmetricKeyAddition = tostring(OldPwd.SymmetricKeyAddition.State),
    NewSymmetricKeyAddition = tostring(NewPwd.SymmetricKeyAddition.State), InitiatedBy
    //ref https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/configure-app-management-policies?tabs=portal

Tags