Please add an alert for any M365 password change, showing the user, timestamp, and initiator (self-service vs. admin). In passkey environments (like Windows Hello for Business), users typically don’t know or need their M365 passwords. That means any password change is a strong signal of risk — either a malicious actor attempting social engineering, or a user trying to bypass passwordless controls.