Multiple Entra ID Admins Removed
'Looks for multiple users that had their admin role removed by a single user within a certain period. The default threshold is 5 removals, this can be edited in the query.'
Microsoft Sentinel (KQL)
'Looks for multiple users that had their admin role removed by a single user within a certain period. The default threshold is 5 removals, this can be edited in the query.'
Already have an account?