External OAuth Application Sign-In via Python Client
Detects sign-in events to Entra ID via service principals where the application is marked as external and enabled, and the user agent string indicates the use of a Python client.
Microsoft Sentinel (KQL)

