Unfamiliar Signin Correlation with AzurePortal Signin Attempts and AuditLogs
'This query looks for unfamiliar Sign-in's thats not seen recently for the given user with azure portal login attempts and audit logs to help detect and reduce the analysis timeline for defenders'
Microsoft Sentinel (KQL)
