Microsoft Entra ID User Security Information Modification
Detects modifications, registrations, or deletions of security information for a user account, or general management updates within the user directory, which may indicate account tampering or unauthorized privilege persistence.
Microsoft Sentinel (KQL)
