Graph API recon of privileged roles, MFA methods, and app consents
Detects suspicious reconnaissance or modification activity within Microsoft Graph API by identifying high volumes of requests targeting sensitive management endpoints (such as directory roles, authentication methods, service principals, or OAuth permissions) from a single actor within a 30-minute window.
Microsoft Sentinel (KQL)
