You want a security trigger for the login and you use this trigger to start the automation workflow with the powershellscript. https://docs.microsoft.com/en-us/azure/storage/common/azure-defender-storage- configure?tabs=azure-security-center https://docs.microsoft.com/en-us/azure/security-center/workflow-automation