Anomalous Data Access Volume by Service Principa

Daniel Koifman@Koifsec

•updated Mar 1, 2026•6•0•43

Service principal data access volume exceeding 3 standard deviations from its 14-day baseline. A service principal that normally accesses 50 mailbox items per hour suddenly accessing 5,000 is a strong exfiltration signal — even though the access itself is “authorized” by its permissions.