New Global Admin Account Created
Detects the creation of a new Global Administrator or Company Administrator account, which may occur after an attacker compromises an Intune administrator to establish persistence and cement full control over the tenant.
Microsoft Sentinel (KQL)
