Account Created Or Deleted By Non-Approved Azure AD Users
This rule detects when user accounts are created or deleted in Azure Active Directory by users who are not on an approved list. It specifically looks for 'Add user' or 'Delete user' messages in the audit logs with a 'Success' status, and then filters out actions initiated by known, approved administrators.
Sigma
