User Granted Access and associated audit activity
'Identifies when a new user is granted access and any subsequent audit related activity. This can help you identify rogue or malicious user behavior.'
Microsoft Sentinel (KQL)

'Identifies when a new user is granted access and any subsequent audit related activity. This can help you identify rogue or malicious user behavior.'

Already have an account?