OAuth App Consent & Privilege Changes for High-Value Apps (Workday & Salesforce)
Detects suspicious OAuth app consents, role assignments, and group changes involving Workday and Salesforce, indicating potential account compromise or privilege escalation.
Microsoft Sentinel (KQL)

