Entra ID Sensitive Group Member Removal
Detects the removal of user accounts from a specific sensitive Microsoft Entra ID group, which may indicate unauthorized group membership changes or potential privilege escalation activities.
Microsoft Sentinel (KQL)
