High-Volume Microsoft Graph API Tenant Reconnaissance

Ibrahim Saud@tektrix

•updated Sep 18, 2026•1•0•1

This rule detects high-frequency and broad-scope enumeration of multiple Microsoft Graph API endpoints by a single identity. By monitoring for access to diverse sensitive categories (organization, users, groups, directoryroles, sites, messages) within a short timeframe, it flags activity patterns consistent with reconnaissance, account discovery, or unauthorized data exploration.