OAuth grant to Google Workspace Migration/Sync for Outlook client IDs
Detects authorization, token grants, or consent events for two specific Google Workspace application ClientIDs, which may be indicative of OAuth application consent abuse or malicious integration.
Microsoft Sentinel (KQL)
