Graph API Directory Role Enumeration for Global/Exchange/Security Admin

Smarth Arora@smarthxarora

•updated Jul 6, 2026•17•0•11

Detects Microsoft Graph API requests that query directory role assignments specifically looking for highly privileged roles such as Global Administrator, Exchange Administrator, or Security Administrator. This activity may indicate an adversary is enumerating privileged roles to identify potential targets for privilege escalation or lateral movement within an Azure/Microsoft 365 environment.