Update rules/integrations/azure/credential_access_azure_entra_susp_device_code_signin.toml

Co-authored-by: Terrance DeJesus <[email protected]>

Author: Samirbous

rules/integrations/azure/credential_access_azure_entra_susp_device_code_signin.toml

@@ -57,7 +57,7 @@ This rule requires the Azure logs integration be enabled and configured to colle
 severity = "high"
 tags = [
     "Domain: Cloud",
-    "Domain: SaaS",
+    "Domain: Identity",
     "Data Source: Azure",
     "Data Source: Entra ID",
     "Data Source: Entra ID Sign-in",