Suspicious Microsoft Graph API Activity by Application
Detects when an application or service principal performs sensitive configuration changes, likely via the Microsoft Graph API. This can indicate an attacker using a compromised or malicious application for persistence (adding credentials), privilege escalation (adding owners), or defense evasion (modifying Conditional Access policies). This aligns with the "Consent & Compromise" research where attackers abuse application permissions.
Microsoft Sentinel (KQL)
