Microsoft 365 Copilot Agent Creation
This detection identifies when Microsoft Copilot Studio agents are created in your organization's tenant. This activity is significant as the default behavior in Copilot agent creation is to configure a new service principal with cloud app administrator role. Copilot agents can be found in the Microsoft Admin Portal https://admin.microsoft.com/Adminportal/Home#/copilot/agents
Microsoft Sentinel (KQL)
