Single-Page-App Refresh Token Used Beyond Its 24h SPA Lifetime Window / From a New Device
Detects anomalous access to the Azure Portal Single Page Application (SPA) by monitoring sign-in logs. The rule flags users accessing this specific application from multiple devices or over an unusually long time span (exceeding 24 hours), which may indicate session hijacking, token theft, or unauthorized access attempts via stolen session tokens.
Microsoft Sentinel (KQL)
