Azure AD User Account Bulk Enumeration

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•3

This rule detects a potential Azure AD user account bulk enumeration attempt. It triggers when a source IP makes 20 or more HTTP requests within 30 seconds to 'graph.microsoft.com' with the URI containing '/users'. This pattern is indicative of an attacker attempting to enumerate multiple user accounts in Azure AD.