Explanation:

For Conditional Access investigations in Microsoft Sentinel, the data source depends on the control plane used. When policies are downloaded via PowerShell , the cmdlets call the Microsoft Graph (e.g., Get- MgIdentityConditionalAccessPol icy ). Those Graph req uests are captured by the Microsoft Graph Activity Logs connector and land in the MicrosoftGraphActivityLogs table. This table records the app identity (such as PowerShell/Graph SDK), the API path (like /identity/conditionalAccess/policies ), verb (GET), an d result, which is ideal for spotting bulk reads/exports of policy definitions.
When policies are updated in the Microsoft Entra admin center , two streams provide visibility. First, directory auditing writes change events (create/update/delete of Condition al Access policies) to Microsoft Entra Audit logs , surfaced in Sentinel as the AuditLogs table, including the actor, target policy, operation (Update policy), and result. Second, the Entra admin center itself is a first-party application that performs the update by invoking Microsoft Graph ; those API calls are also recorded in MicrosoftGraphActivityLogs (with verb PATCH/POST and the policy resource path).
Therefore, to cover both perspectives- the authoritative audit record and the underlying API activity - you should query AuditLogs and MicrosoftGraphActivityLogs for updates, and MicrosoftGraphActivityLogs for downloads executed through PowerShell.