Azure Device No Longer Managed or Compliant
This rule identifies when a device registered in Azure Active Directory (now Microsoft Entra ID) transitions to a state where it is no longer considered managed or compliant. This could indicate a change in device policy, a device being unenrolled, or a security posture degradation.
Sigma
