Created by Claude - please verify

CA changes - directory audit events logged by Conditional Access, old and new policy JSON compared setting by setting.

Required Microsoft Graph permissions

AuditLog.Read.All — application permission, granted to the app registration with admin consent.

Licence: None.

Endpoint: GET /v1.0/auditLogs/directoryAudits?$filter=loggedByService eq 'Conditional Access'

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

Conditional Access Change History with Diff (30 days)

Who changed which Conditional Access policy, and exactly what changed. Deleted and disabled policies, switches to report-only and new exclusions are marked as weakening - the changes attackers make after gaining admin rights, and the ones auditors ask about.