SOP-47: Conditional Access Policy Tampering Response

SOC analyst SOP for Conditional Access policy tampering in Microsoft Entra ID. Covers policy deletion, MFA exclusion insertion, named location bypass, and authentication control weakening.