Detections/SigninLogs/DisabledAccountSigninsAcrossManyApplications.yaml (5 lines of code) (raw):

id: de67574e-790f-44a6-9ca0-92ebfa48817f name: Attempts to sign in to disabled accounts description: | 'As part of content migration, this file is moved to a new location. You can find it here https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Entra%20ID/Analytic%20Rules/DisabledAccountSigninsAcrossManyApplications.yaml' version: 1.0.2