Sign-ins and Authentication methods for privileged Entra ID users
Detects which privileged users have signed in recently, how often, from how many IPs/apps, what authentication methods they used, and whether any password-only sign-ins occurred?
Microsoft Sentinel (KQL)
