AzureAD & Office365 detection rules