AADSTS700016 client ID not found in tenant (client ID spoofing)
Detects multiple authentication failure attempts (error code 700016: Application not found in directory) originating from the same IP address against multiple user accounts. This pattern is indicative of an adversary attempting to find or exploit service principals or misconfigured applications across the tenant.
Microsoft Sentinel (KQL)
