External Guest Accounts Added in EntraID
This detection looks for external guest accounts being added to a company EntraID, where the external guests target resource does not contain the company domain. This activity can indicate compromise and now the threat actor is looking to maintain persistence through the creation of accounts.
Microsoft Sentinel (KQL)
