Office 365 Email Account Enumeration via Graph API

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•4

This rule detects potential Office 365 email account enumeration attempts via the Microsoft Graph API. It triggers when a source IP makes 20 or more HTTP requests within 30 seconds to 'graph.microsoft.com' with URIs containing both '/users/' and '/mailboxSettings'. This pattern is indicative of an attacker attempting to discover valid user accounts and their mailbox settings.