New AI Agent Created With Excessive Org-Wide Sharing Permissions
This takes the earliest available snapshot per agent instead of comparing two states. If an agent is born already carrying MCP access and org-wide sharing there is no baseline to drift from, so this needs its own check rather than a diff.
Microsoft Sentinel (KQL)
