New Azure AD User Account Created via Graph API

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•4

This rule detects the creation of a new Azure AD user account via the Microsoft Graph API. It specifically looks for HTTP POST requests to 'graph.microsoft.com' with the URI containing '/users'. This activity could indicate an attacker establishing persistence by creating new accounts in a compromised Azure AD environment.