Activity Performed by Terminated User
Detects when Microsoft Cloud App Security reports activities performed by users whose accounts have been terminated in Azure AD, but are still active in other platforms like AWS or Salesforce. This is particularly relevant for accounts used to manage resources that might not be terminated when a user leaves the company.
Sigma
