App Proxy/Custom SSO External Endpoint Added for Persistence
Detects modifications to Microsoft Entra ID (formerly Azure AD) applications, service principals, or Application Proxy configurations that could be indicative of an adversary establishing persistent external access. This includes updates to external URLs, SSO settings, and authentication types, which are frequently used to facilitate persistence via malicious cloud application configurations.
Microsoft Sentinel (KQL)
