Microsoft 365 Account Activity Monitoring
This rule monitors the Microsoft 365 AuditLogs to retrieve and investigate all actions taken by or against a specific user account. It expands the TargetResources field to extract the TargetUPN and filters for a specific account, providing a timeline of operations, the actor who initiated the action, and the result of the operation.
Microsoft Sentinel (KQL)
