This analytic detects the installation of Azure AD and cloud management modules via PowerShell Script Block Logging. Tools such as AADInternals, AzureAD, MSOnline, and Az.Resources provide deep access ...