Elevated Azure AD Sign-In Risk to Microsoft Teams Amid External Contact Spike
Detects Azure AD sign-ins to Microsoft Teams flagged with an elevated risk state, which may indicate cloud account abuse following external Teams-based social engineering contact preceding a broader spike in malicious M365 activity.
Microsoft Sentinel (KQL)

