OAuth App Consent & Privilege Changes for High-Value Apps (Workday & Salesforce)

Detects suspicious OAuth app consents, role assignments, and group changes involving Workday and Salesforce, indicating potential account compromise or privilege escalation.