Sign-in from Starlink IP Address
This rule detects sign-in attempts originating from IP addresses associated with Starlink (Space Exploration Technologies) autonomous system. This could indicate an unusual access vector, especially if Starlink is not a common or expected internet service provider for the organization's users.
Microsoft Sentinel (KQL)

