Entra ID mass device registration by one account with microsoft-*/WINDOWS-* name
Detects five or more Entra ID device registrations by a single account where device names match microsoft-* or WINDOWS-* patterns, occurring shortly after a device code flow sign-in by the same account. This behavior is indicative of device registration abuse or persistent access attempts.
Microsoft Sentinel (KQL)
