Microsoft Graph Bulk User Directory Enumeration
Detects a user or application issuing a high volume of Microsoft Graph user directory requests within ten minutes, consistent with tenant reconnaissance. This rule specifically looks for GET requests to the /v1.0/users endpoint of the Microsoft Graph API, indicating an attempt to enumerate user accounts.
Microsoft Sentinel (KQL)
