Suspicious Sign-ins from Bots/Crawlers with Conditional Access Not Applied

Ankit Mehta@Secvyn

•updated Jun 17, 2026•2•0•5

This rule detects suspicious sign-in attempts to Azure AD where Conditional Access policies were not applied, the sign-in was successful, and the user agent string indicates a bot, crawler, headless browser, or common scripting tools like curl, wget, or python. It specifically looks for multiple such logins or logins from multiple unique devices within a 5-minute window for the same user and risk detail.