Conditional Access Change History with Diff (30 days)
The question it answers: Who changed which Conditional Access policy in the last 30 days, what exactly changed, and did it weaken protection?
Who changed which Conditional Access policy, and exactly what changed. Deleted and disabled policies, switches to report-only and new exclusions are marked as weakening - the changes attackers make after gaining admin rights, and the ones auditors ask about.
At a glance
Section titled “At a glance”| Where in the app | Entra ID › Sign-in & Audit Investigations › CA Change History (diff) |
| Workload | Entra ID |
| Kind | Findings list · dashboard tile |
| Data | Read from Microsoft 365 when someone first opens it, then kept for the report cache lifetime (Settings > Data & cache, 1 hour unless changed). |
| Licence | No extra licence needed. |
| Report id (API and MCP) | entra.investigations.ca-change-history |
Columns
Section titled “Columns”| Column | Key | Type |
|---|---|---|
| Severity | Severity | Status |
| Activity | Category | Text |
| Policy | Subject | Link |
| Check | Setting | Text |
| Changed by | Value | Text |
| Finding | Finding | Text |
| Diff (old -> new) | Detail | Text |
| When | When | DateTime |
| Settings changed | Number | Number |
A findings list hides columns that no row fills. Severity is Critical, Serious, Warning, OK or Info; rows rated Critical, Serious or Warning need attention (Working with findings).
What it needs
Section titled “What it needs”Licence: No extra licence needed.
Application permissions on the IntensiveReports app registration (all permissions):
| Permission | API | What it allows | Note |
|---|---|---|---|
AuditLog.Read.All | Microsoft Graph | Read all audit log data |
Data sources it reads
GET /v1.0/auditLogs/directoryAudits?$filter=loggedByService eq 'Conditional Access'
Through the API and MCP
Section titled “Through the API and MCP”GET /ir-api/v1/reports/entra.investigations.ca-change-history?size=100An AI assistant reads it with the MCP tool get_report and the id entra.investigations.ca-change-history. The client needs the Read grant for Entra ID. See Using the API.