Graph API Recon: Role Assignments

Ibrahim Saud@tektrix

•updated Jun 18, 2026•3•0•10

Detects high-velocity queries to Graph API regarding transitiveRoleAssignments, a Tycoon 2FA post-compromise activity. This activity is indicative of reconnaissance for role assignments within Microsoft Graph, potentially by an adversary like Volt Typhoon (Tycoon 2FA).