Anthropic SSO Disabled or Connection Removed

Last updated 4 days ago on 2026-09-21

Created 13 days ago on 2026-09-12

About

SSO routes Anthropic authentication through the corporate identity provider. Disabling SSO, or deactivating or deleting an SSO connection, moves users onto alternate sign-in paths where IdP-enforced MFA, conditional access, and session policies no longer apply. That opens the door to password or magic-link accounts the attacker controls.

Tags

Domain: GenAIDomain: IdentityPlatform: AnthropicData Source: Anthropic Audit LogsUse Case: Identity and Access AuditUse Case: Threat DetectionRule Type: ES|QLTactic: Defense EvasionLanguage: esql

Severity

high

Risk Score

MITRE ATT&CK™

Defense Evasion (TA0005)(external, opens in a new tab or window)

↳ Modify Authentication Process (T1556)(external, opens in a new tab or window)

False Positive Examples

Identity provider directory sync and SCIM provisioning can deactivate or delete SSO connections during IdP migrations, directory attribute changes, or connector maintenance. If `anthropic.audit.actor.type` is `scim_directory_sync_actor`, correlate with WorkOS or Okta change windows before escalating. Administrators deactivate or delete SSO connections during identity provider migrations, certificate rotation, or maintenance. Validate the actor, `anthropic.audit.connection_id`, and whether SSO was restored after the change.

License

Elastic License v2(external, opens in a new tab or window)

Definition

Integration Pack: Prebuilt Security Detection Rules
Related Integrations: anthropic(external, opens in a new tab or window)
Query

✄𐘗text code block:
✄𐘗from logs-anthropic.audit-* metadata _id, _version, _index
| where
    data_stream.dataset == "anthropic.audit" and
    mv_contains(event.category, "iam") and
    (
        event.action in ("org_sso_connection_deactivated", "org_sso_connection_deleted") or
        (event.action == "org_sso_toggled" and anthropic.audit.enabled == false)
    )
| keep _id, _version, _index, @timestamp, event.*, organization.*, user.*, source.*, user_agent.*, anthropic.audit.*, data_stream.*

Install detection rules in Elastic Security

Detect Anthropic SSO Disabled or Connection Removed in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).