Microsoft Graph API High-Value Reconnaissance (Tycoon 2FA)

Duo Tech@duotech

•updated Jun 1, 2026•2•0•8

Identifies bursts or requests to high-value Microsoft Graph API discovery endpoints. Tycoon 2FA operators frequently perform automated burst reconnaissance against these endpoints post-compromise to map out roles, tenant relationships, mailbox settings, and contacts.