O365 Admin Login Activity To Uncommon Microsoft Cloud Apps

Google SecOps@GoogleSecOps

•updated Apr 1, 2025•0•0•1

This rule detects O365 login activity to apps other than a defined list of first party MS Cloud Apps. Note that Azure Active Directory PowerShell and custom Azure apps are not in this list by default