Azure Owner Removed From Application or Service Principal
This rule identifies when an owner is removed from an application or service principal within Azure Active Directory. This activity could indicate an attempt to remove legitimate administrative access or to obscure malicious activity by removing an owner who might detect it.
Sigma
