This rule detects changes to Anthropic SSO configuration that bypass IdP-based MFA and session policies by deactivating or deleting the SSO connection or toggling SSO off. Triggered events come from Anthropic audit logs (logs-anthropic.audit*) and target iam-related actions: org_sso_connection_deactivated, org_sso_connection_deleted, or org_sso_toggled with anthropic.audit.enabled == false. Since SSO is the primary path enforcing corporate MFA and session policies, these changes can move authentication onto attacker-controlled paths (password or magic-link). The rule maps to MITRE ATT&CK T1556 (Modify Authentication Process) under Defense Evasion (TA0005) and includes contextual fields to aid investigation (organization, account, and connection identifiers, actor type). The detection is labeled with a high severity and a notable risk score, reflecting the potential impact of bypassing IdP controls. The rule provides a structured query and an investigation guide to help analysts assess whether a change was expected (maintenance window) or malicious, and what follow-up actions are warranted.