New Device Registration Followed by Risky or Management Sign-in
This rule detects scenarios where a user account registers or adds a new device and subsequently performs a sign-in session within one hour that is either marked as high/medium risk or occurs via sensitive applications like the Azure Portal or Microsoft Graph. This pattern often indicates account compromise, where an attacker has registered a rogue device to gain persistent access or perform administrative tasks.
Microsoft Sentinel (KQL)
