Entra Sign-In Enumeration Traffic from AWS or Cloudflare Hosting Infrastructure
Detects sign-in activity in Entra ID where the application display name is blank, despite an Application ID being present, originating from known cloud service provider IP ranges (AWS or Cloudflare). This pattern is consistent with automated enumeration or discovery tools that leverage OAuth client ID spoofing or misconfigurations to identify valid tenants or users.
Sigma
