Microsoft Teams External Communication from Non-Whitelisted Domains
This rule detects Microsoft Teams chat or call activity initiated by external users whose domains are not present in a pre-defined whitelist. It specifically looks for 'ChatCreated' or 'CallParticipantDetail' actions from external users and filters out activity from known, whitelisted external domains. This can help identify potentially unauthorized or suspicious communication with external entities.
Microsoft Sentinel (KQL)
