Entra ID sign-ins with blank or unregistered application (client) ID
Detects repeated sign-in attempts using unrecognized, malformed, or blank Application IDs (AppId). This often indicates automated reconnaissance or brute-force attempts targeting applications or service principals within the Azure Active Directory environment.
Microsoft Sentinel (KQL)
