Hunt for Undocumented API - Estimate Access called in Microsoft Graph API

Google SecOps@GoogleSecOps

•updated Feb 24, 2025•0•0•2

Estimate Access is an undocumented API in MS Graph and is used in the following GraphRunner functions Get-UpdatableGroups, Get-DynamicGroups and Invoke-GraphRecon. Although not inherently malicious, it does submit an action and then determines if the user can perform it