Suspicious OAuth App Consent Grant in Azure AD
Detects OAuth application consent grants or modifications where the application is granted sensitive permissions including Mail.Read, Directory.Read.All, or User.Read.All. These permissions can be abused by attackers to exfiltrate email data or map the organization's directory.
Microsoft Sentinel (KQL)
