OWA AppID mailbox harvesting via anomalous Graph API path

Ankit Mehta@Secvyn

•updated Sep 10, 2026•0•0•0

Detects high-frequency access to mail items or attachments using specific One Outlook Web Client AppIDs. This behavior may indicate automated mailbox harvesting or unauthorized bulk data access via an atypical API path.