Bulk Deletion Changes To Privileged Account Permissions in Azure AD
Detects when a user is removed from a privileged role in Azure AD. Bulk changes should be investigated as they could indicate an adversary attempting to remove legitimate administrators or clean up their tracks after gaining access.
Sigma
