Logon Detected on Stolen or Missing Device
This detection identifies successful logon activity (Event ID 4624) on a device that has been reported as stolen or missing. Such activity is highly suspicious and could indicate unauthorized access. The rule enriches the alert with ISP IP information from Azure AD sign-in logs to aid in investigation.
Microsoft Sentinel (KQL)
