Broad Intune Group Assignment
Detects assignments of Intune objects (such as policies, scripts, or applications) to high-impact default groups like 'All Devices' or 'All Users'. Adversaries leverage these broad assignments to maximize the blast radius of malicious payloads or destructive wipe commands.
Microsoft Sentinel (KQL)
