Excessive Entra ID App Permission Grant or Consent
Detects newly granted or consented Microsoft Entra ID application permissions exceeding baseline, a weakness CISA's red team exploited to escalate privileges and reach cloud resources.
Microsoft Sentinel (KQL)
