Dev-to-prod access by same account from IP new to user prod baseline
Detects instances where a user account accesses a development resource and subsequently accesses a production resource from the same source IP address, where that IP address has not been historically used by the user for production access within a defined baseline period.
Microsoft Sentinel (KQL)
