Anomalous sign-in location by user account and authenticating application - with sign-in details
'This query examines Microsoft Entra ID sign-ins and identifies anomalous changes in a user's location profile. A variation joins results back onto the original sign-in data to review the location set with each identified user in tabular form.'
Microsoft Sentinel (KQL)
