Anomalous Microsoft Entra ID apps based on authentication location
'This query over Microsoft Entra ID sign-in activity highlights Microsoft Entra ID apps with an unusually high ratio of distinct geolocations versus total number of authentications'
Microsoft Sentinel (KQL)
