Anomalous Sign-In to My Sign-Ins Security Portal
This rule aggregates Azure AD sign-in logs for a specific application, grouping by user principal name, IP address, location, and device ID. It provides a baseline view of user authentication patterns to identify unusual sign-in activity such as anomalous login locations or device usage.
CQL
