Detection rules › By event

M365-PowerPlatformAdministratorActivity

Event	Rules
any	4
GovernanceApiPolicyOperation	1
PutConnection	1

any

4 detection rules reference this event. View event page.

Kusto (4)

Dataverse - Guest user exfiltration following Power Platform defense impairment severity high T1567, T1629
Power Apps - App activity from unauthorized geo severity low T1078
Power Apps - Bulk sharing of Power Apps to newly created guest users severity medium T1534, T1566, T1587
Power Apps - Multiple apps deleted severity medium T0826, T1485

GovernanceApiPolicyOperation

1 detection rules reference this event. View event page.

Kusto (1)

Power Platform - DLP policy updated or removed severity low T1480

PutConnection

1 detection rules reference this event. View event page.

Kusto (1)

Power Platform - Connector added to a sensitive environment severity low T0871, T1537, T1567