Power Automate Flow Abuse via External/Personal Email Connectors
Detects the creation or modification of Power Automate flows that involve potentially sensitive external services or personal email providers, which may indicate data exfiltration or unauthorized integration setup.
Microsoft Sentinel (KQL)

