Entra ID Enumeration via AzureHound or ROADrecon User-Agent
Detects enumeration of Entra ID applications and permissions via AzureHound or ROADrecon, identified by distinct user-agent strings or abnormal Graph API request volume — the same signal Organization B's custom alerts used to catch CISA's red team.
Microsoft Sentinel (KQL)
