Bulk Microsoft Graph API Enumeration by Scanner

Ankit Mehta@Secvyn

•updated Jun 29, 2026•3•0•8

This rule detects potentially malicious reconnaissance or enumeration activity by identifying a high volume of Microsoft Graph API requests (GET requests) to sensitive directory endpoints (users, groups, directoryRoles, servicePrincipals) from a single application identity (AppId) and IP address within a short time window.