Contributed to the elastic/detection-rules repository by developing three detection rules targeting Entra ID identity attacks, focusing on scenarios such as Temporary Access Pass creation, guest-to-member account promotion, and OAuth application redirect URI modifications. The work involved authoring detection logic, defining precise queries, and updating TOML rule files to enhance Azure integration and cloud security coverage. Incorporated reviewer feedback to refine field-paths and MITRE mappings, ensuring alignment with credential access and persistence techniques. Collaborated closely with other contributors, emphasizing identity management and security analysis. These additions enable earlier detection of unauthorized access attempts without requiring new app registrations or consent events.