Rare or Newly Observed Cloud Application Sign-ins (Anomaly Detection)
This query identifies rare or newly observed application sign-ins by comparing activity in the last 24 hours against a 30‑day historical baseline. It highlights applications that are never used or seldom used in the tenant, helping detect anomalous or suspicious application activity that may indicate OAuth abuse, automation tools, or compromised accounts.
Microsoft Sentinel (KQL)
