Spoofed Outlook client user agent mismatched with client ID in Entra ID sign-ins
Detects login attempts using an Outlook/Office-specific User-Agent string where the application being accessed does not match common Microsoft 365 services (Outlook, Office, Exchange, Teams, OneDrive, SharePoint, ActiveSync, or Skype). This pattern is often indicative of programmatic attempts to bypass or spoof standard application signatures during credential stuffing or brute force campaigns.
Microsoft Sentinel (KQL)
