Walid Ben Abdallah (@walid)

AAD Unauthorized Deletion Detection

KQL

This rule identifies and monitors deletion operations in Azure Active Directory (AAD) that could indicate unauthorized activity. It excludes routine deletions, such as security information or device removals, and captures details about the initiating user, target user/group, and their IP address. The rule helps detect potentially anomalous or suspicious deletion actions, enhancing AAD security monitoring.