Azure AD Risky User and Sign-in Activity Detected

Shadows VMB@Vemorian_Mort

•updated Aug 20, 2026•23•0•42

This rule monitors for high or medium-risk user events and sign-in activities within Azure Active Directory. It correlates data from both the AADUserRiskEvents and SigninLogs tables to identify potentially compromised user accounts.