Azure AD Sign-in to CAP-Bypass App without Conditional Access
Detects successful sign-ins to specific Azure AD applications known to bypass Conditional Access policies, where Conditional Access was not applied. This could indicate an attempt to circumvent security controls.
Microsoft Sentinel (KQL)
