Mass SharePoint/OneDrive download by a single identity or app (data-staging exfil)

Ankit Mehta@Secvyn

•updated Aug 8, 2026•4•0•4

Detects instances where a single user account performs a large volume of file downloads (50 or more unique files) within a 30-minute window from Office 365 services. This behavior may indicate unauthorized data exfiltration or mass collection of sensitive information.