Monitor and alert on conditional access changes where non approved actor removed CA Policy.
Read the full analysis on IntelFusions