Managed ITDR

An alert should be generated if a random global admin account is created in an office 365 tenant. When a user is assigned privileged access it very well could be an IoC

Have a m365 ITDR client that has 8 authoritative domains and we manage 6 of the 8.

While other escalation and incidents include the organization name somewhere in the body of the email notification, it is not included in the specific escalation "Login without Usage Location".