Microsoft Graph Authorization Policy API Call Detection
This rule detects attempts to retrieve the Microsoft Graph authorization policy, specifically targeting the `/policies/authorizationPolicy` endpoint. This policy contains sensitive information about who can create applications, invite guest users, and other critical settings within Entra ID (formerly Azure AD). Such requests are typically made by administrators for review or modification, and unexpected calls to this endpoint could indicate reconnaissance or unauthorized access attempts. The rule filters for successful GET requests (HTTP 200) and excludes known Azure IP ranges to reduce false positives.
YARA-L
