Successful Sign-in from Suspicious User Agent and Unusual Country
This rule detects successful user sign-ins to Azure AD from IP addresses located outside of New Zealand and Australia, where the User-Agent string matches a known list of suspicious user agents. It filters out common legitimate user agents to reduce false positives.
Microsoft Sentinel (KQL)
