High-Volume Microsoft Graph API Tenant Reconnaissance

Ibrahim Saud@tektrix

•updated Sep 16, 2026•2•0•5

Detects high-frequency access to multiple sensitive Microsoft Graph API paths (users, groups, applications, directoryRoles, servicePrincipals, etc.) from a single identity within a short timeframe. This pattern is indicative of automated reconnaissance or enumeration of the cloud environment's identity and application landscape.