Activity from Infrequent Country Reported by Microsoft Cloud App Security
Detects when Microsoft Cloud App Security reports an activity originating from a country that has not been recently or ever visited by any user within the organization. This indicates potential unauthorized access or anomalous user behavior from an unusual geographic location.
Sigma
