Rapid Sequential Sign-Ins to Identity Apps Post-Compromise Enumeration

Ibrahim Saud@tektrix

•updated Sep 16, 2026•2•0•4

Detects anomalous access patterns to Microsoft 365 SaaS applications where a single user session interacts with three or more specific portal applications (such as 'OfficeHome', 'My Apps', 'My Profile') within a five-minute window. This behavior may indicate an adversary attempting to map the environment or interact with multiple integrated services shortly after gaining access.