Power Platform - Possibly compromised user accesses Power Platform services

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Content Index

---

Identifies user accounts flagged at risk in Microsoft Entra Identity Protection and correlates these users with sign-in activity in Power Platform, including Power Apps, Power Automate and Power Platform Admin Center.

Attribute	Value
Type	Analytic Rule
Solution	Microsoft Business Applications
ID	54d48840-1c64-4399-afee-ad39a069118d
Severity	High
Status	Available
Kind	Scheduled
Tactics	InitialAccess, LateralMovement
Techniques	T1078, T1210
Required Connectors	AzureActiveDirectory
Source	View on GitHub

Tables Used

This content item queries data from the following tables:

Table	Transformations	Ingestion API	Lake-Only
SigninLogs	✓	✗	?

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Analytic Rules · Back to Microsoft Business Applications