Improve AAD Identity Protection Detections
AAD Identity Protection Detections need to be improved and should have similar detections as what offers Microsoft Defender for Identity. (https://docs.microsoft.com/en-us/defender-for-identity/what-is)
Example of a UseCase needed by AAD IP:
Reconnaissance on AAD is possible through Graph API (Using ROADrecon) without any detections, and isn't even audited.
There should at least be detailed logging available in order to use Sentinel for custom alerts.