@Alex Rourke I'm thinking maybe there is a way to do this with the Azure Sentinel but seems like overkill for a whitelist task. I'm hoping MSFT team can provide guidance on this one.

We support Ukraine and condemn war. Push Russian government to act against war. Be brave, vocal and show your support to Ukraine. Follow the latest news HERE