Microsoft Teams IT Helpdesk Impersonation
Detects potential Microsoft Teams impersonation or social-engineering activity where accounts use IT, admin, support, or security-themed display names, especially when associated with external users or impersonation indicators.
Microsoft Sentinel (KQL)
