Adversaries may disable or modify conditional access policies to enable persistent access to compromised accounts. Conditional access policies are additional verifications used by identity providers and identity and access management systems to determine whether a user should be granted access to a resource.

For example, in Azure AD, Okta, and JumpCloud, users can be denied access to applications based on their IP address, device enrollment status, and use of multi-factor authentication.(Citation: Microsoft Conditional Access)(Citation: JumpCloud Conditional Access Policies)(Citation: Okta Conditional Access Policies) In some cases, identity providers may also support the use of risk-based metrics to deny sign-ins based on a variety of indicators. In AWS and GCP, IAM policies can contain `condition` attributes that verify arbitrary constraints such as the source IP, the date the request was made, and the nature of the resources or regions being requested.(Citation: AWS IAM Conditions)(Citation: GCP IAM Conditions) These measures help to prevent compromised credentials from resulting in unauthorized access to data or resources, as well as limit user permissions to only those required. 

By modifying conditional access policies, such as adding additional trusted IP ranges, removing [Multi-Factor Authentication](https://attack.mitre.org/techniques/T1556/006) requirements, or allowing additional [Unused/Unsupported Cloud Regions](https://attack.mitre.org/techniques/T1535), adversaries may be able to ensure persistent access to accounts and circumvent defensive measures.
Conditional Access Policies
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1556/009  external_id: T1556.009     source_name: AWS IAM Conditions  description: AWS. (n.d.). IAM JSON policy elements: Condition. Retrieved January 2, 2024.  url: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition.html     source_name: GCP IAM Conditions  description: Google Cloud. (n.d.). Overview of IAM Conditions. Retrieved January 2, 2024.  url: https://cloud.google.com/iam/docs/conditions-overview     source_name: JumpCloud Conditional Access Policies  description: JumpCloud. (n.d.). Get Started: Conditional Access Policies. Retrieved January 2, 2024.  url: https://jumpcloud.com/support/get-started-conditional-access-policies     source_name: Microsoft Conditional Access  description: Microsoft. (2023, November 15). What is Conditional Access?. Retrieved January 2, 2024.  url: https://learn.microsoft.com/en-us/entra/identity/conditional-access/overview     source_name: Okta Conditional Access Policies  description: Okta. (2023, November 30). Conditional Access Based on Device Security Posture. Retrieved January 2, 2024.  url: https://support.okta.com/help/s/article/Conditional-access-based-on-device-security-posture?language=en_US     