Azuresentinel

Looking for suspicious activity in Azure Sentinel based on non-admin users logging in to AzureAD or Exchange Online PowerShell