Azure Bastion Session from New User or Anomalous Country
Detects Azure Bastion RDP or SSH tunnel sessions initiated by users who have no history of using Bastion in the last 60 days, or by users connecting from a geographic location not observed in their recent sign-in history. This behavior may indicate account compromise and unauthorized lateral movement attempts.
Microsoft Sentinel (KQL)
