All Detections

Break-Glass Account Usage - On-Premises Active Directory

avatar
Alex Acosta@razerTos71
updated Nov 18, 2025280377

Detects any authentication activity (successful or failed) for emergency break-glass administrative accounts

Microsoft Sentinel (KQL)