KQL - Hybrid Identity User Change Tracker (AD + Entra ID)
Tracks changes and activities affecting a specific user account across both on-premises Active Directory and Microsoft Entra ID. The query combines Windows Security Events and Entra ID Audit Logs into a single timeline, making it easier to investigate account modifications, privilege changes, MFA updates, directory synchronization activity, and administrative actions impacting a user. This detection is particularly useful during incident response, insider threat investigations, account compromise assessments, and user lifecycle reviews
Microsoft Sentinel (KQL)
