Undocumented AAD Graph (graph.windows.net / aadiam "Ibiza") API Calls with No Corresponding Entra Sign-in or Graph Audit Log
This rule detects anomalous activity involving the legacy Microsoft Azure AD Graph API (graph.windows.net) originating from users who lack corresponding entries in standard Entra ID (AuditLogs) sign-in or management activity logs. A high frequency of these undocumented API calls (more than 5 in an hour) from a specific user and IP address indicates potential unauthorized reconnaissance or access attempts attempting to bypass standard audit logging.
Microsoft Sentinel (KQL)
