Graph API Reconnaissance of Roles, MFA Methods & Service Principals

Ibrahim Saud@tektrix

•updated Sep 18, 2026•1•0•3

Detects anomalous activity in Microsoft Graph API logs where a single identity (user or application) performs a high volume of requests across multiple sensitive administrative categories, such as directory role management, authentication method modification, application or service principal changes, and OAuth consent operations. This pattern is indicative of potential unauthorized reconnaissance, privilege escalation, or persistence attempts within an Azure/Microsoft 365 environment.