Graph API Recon: Contacts/Skus

Ibrahim Saud@tektrix

•updated Jun 18, 2026•1•0•9

Detects queries extracting large contact lists or license details ($top=999 or $top=1000) via Microsoft Graph API, indicating automated data harvesting or reconnaissance activities. This behavior could be indicative of an adversary attempting to collect information about an organization's users or licensed software.