Microsoft Teams Messages Bulk Harvested via Graph API

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•4

This rule detects bulk harvesting of Microsoft Teams messages via the Graph API. It triggers when a client makes 20 or more HTTP requests within 60 seconds to graph.microsoft.com with URIs containing both '/teams/' and '/messages'. This behavior could indicate an attempt to exfiltrate a large volume of communication data from Microsoft Teams.