Teams Meeting Recording Bulk Download via Graph API (>5 in 1h)

Ankit Mehta@Secvyn

•updated Jun 26, 2026•6•0•9

Detects anomalous activity where a single user or service principal downloads more than 5 Microsoft Teams meeting recordings within a 1-hour window. This behavior potentially indicates an insider threat or compromised account performing bulk harvesting of sensitive meeting content.