ARToken Graph API Proxy Access from Newly Registered Device

Ibrahim Saud@tektrix

•updated Sep 19, 2026•0•0•2

Detects access to Microsoft Graph API endpoints related to mail, contacts, drive, or messages from a device that was registered within the last 24 hours. This behavior may indicate an adversary using stolen session tokens or credentials to access cloud-based email and data shortly after device registration or enrollment.