Unusual Azure Operation by Identity

This rule identifies statistically unusual or first-time Azure operations performed by a principal (user or service principal). It uses a risk-based alerting model, assigning a higher risk score to operations defined as high-risk. The rule establishes a baseline of normal activity over 30 days and alerts when current activity significantly deviates from this baseline or when an operation is observed for the very first time for a given identity.