Rare Subscription-level Operations In Azure — Detection Rule

Identifies IPs from which users grant access to other users on azure resources and alerts when a previously unseen source IP address is used.