O365 AD PowerShell App Login Subsequent Activity

Google SecOps@GoogleSecOps

•updated Jun 2, 2025•0•0•3

Once a user authenticates to the Azure AD PowerShell application, if they take multiple admin actions indicative of establishing their own persistence with an Entra ID application within a portion of the access token time, alert for additional investigation