Non-Interactive Microsoft Graph API Access via Stolen Token Proxy

Ibrahim Saud@tektrix

•updated Sep 19, 2026•0•0•2

Detects non-interactive sign-in events to the Microsoft Graph API by applications that are not part of a known set of standard Microsoft applications. This pattern may indicate the use of stolen access tokens or compromised sessions (e.g., via device code phishing) to access M365 data without user interaction.