Device code sign-in followed by same-session replay from different IP/ASN
Detects a successful device-code sign-in whose session is replayed successfully within 60 minutes from a different IP and ASN. Only successful replays count (interrupt codes removed) and Microsoft first-party ASN egress is excluded.
Microsoft Sentinel (KQL)
