Microsoft Graph Service Principal Permission Enumeration
Detects collection of service principals, app role assignments, delegated grants, and ownership data via Microsoft Graph API, which can identify privilege escalation paths. The rule specifically looks for a high volume of GET requests (35 or more within a 15-minute window) to URIs associated with enumerating service principals, app role assignments, oauth2 permission grants, and owned objects.
Microsoft Sentinel (KQL)
