An alert should be generated if a random global admin account is created in an office 365 tenant. When a user is assigned privileged access it very well could be an IoC