High-Fidelity Azure AD User Risk Detection
Microsoft Entra ID Protection can provide a broad range of risk detections that can be used to identify suspicious activity in your organization. This KQL detection rule identifies and prioritizes high-fidelity user risk events in Azure AD. It focuses on high-fidelity risk event types, filtering out known, noisy, or low-fidelity events to ensure alerts are accurate, actionable, and reliable.
Microsoft Sentinel (KQL)
