I'm having a issue with users creating apps in power apps, so now I want to make a KQL alert in sentinel that alerts me when a resource has been added. I thought about querying AAD, but not really sure where to start with that. Does anybody have any thoughts or can lead me into the next steps?
