Cortex XDR Cloud Compromise Alerting

To anyone using Palo Alto's Cortex XDR, how well have you seen it perform on detecting and alerting on Microsoft 365 cloud compromise events? We've recently moved over to them and it misses a ton of concerning cloud only events that we'd assume they would catch. We obviously have Multifactor Authen