VIP Account Monitoring: Entra ID, CA Policy, Role Changes & Sign-ins
Detects activity related to high-value (VIP) accounts, including: - Azure AD account modifications - Conditional Access policy changes affecting the user - Role assignment changes - Mailbox rule creation/modification - Successful sign-ins Useful for tracking executive account abuse, targeted attacks, or policy misconfigurations.
Microsoft Sentinel (KQL)
