Unexpected AI Agent / Bot Access to Sensitive Resources
Detects instances where identified AI agents, bots, or automated assistants perform bulk access operations on mailboxes (e.g., MailItemsAccessed, Send, deletions) or data stores (e.g., FileDownloaded, FileAccessed, SearchQueryPerformed) in Microsoft 365 environments. This monitors for potentially compromised or malicious AI service accounts abusing legitimate access to harvest sensitive data.
Microsoft Sentinel (KQL)
