Email Delegate Permission Added via Graph API

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•3

This rule detects attempts to add email delegate permissions via the Microsoft Graph API. It specifically looks for HTTP PATCH requests to 'graph.microsoft.com' with a URI containing 'mailboxSettings'. This activity could indicate an attacker attempting to gain unauthorized access to a user's mailbox by granting delegate access to another account, which is a common persistence technique.