Suspicious OAuth Consent Followed by SaaS Data Access Activity
Detects suspicious OAuth consent or connected app authorization followed by SaaS query, export, download, or bulk API activity from the same account within 24 hours, indicating possible OAuth token abuse or SaaS data exfiltration.
Microsoft Sentinel (KQL)
