Entra ID Login Activity to Uncommon MS Cloud Apps

Google SecOps@GoogleSecOps

•updated Apr 1, 2025•0•0•0

This rule detects Azure AD login activity to apps other than a defined list of first party MS Cloud Apps. Note that Azure Active Directory PowerShell and custom Azure apps are not in this list by default