Azure AD Security PowerShell Endpoints

Guidance is from the following. Blocking PowerShell for EDU Tenants

The issue is unless there is a policy that requires mfa for all cloud apps and for all users, the PowerShell endpoints are open season. here is a kql statement to help find who is using them. https://github.com/chadmcox/Azure_Active_Directory/blob/master/Log%20Analytics/find-msolusage.kql

• Create a group in Azure AD
  • Name: Allow Azure AD PowerShell
  • Copy the group's id (guid)