ROPC Single‑Factor Login from New Country or App (MFA Bypass Risk)
This detection identifies single-factor ROPC (Resource Owner Password Credentials) logins from new countries not seen in the last 14 days for a given user+app combination. ROPC authentication does not support MFA, making it a frequent vector for attackers to bypass MFA misconfigurations and gain initial access or escalate privileges in Azure AD.
Microsoft Sentinel (KQL)
