SharePoint/OneDrive Discovery via Graph Search, Children, Delta Queries
Detects anomalous, high-volume enumeration of SharePoint and OneDrive resources via Microsoft Graph API by monitoring for repeated access patterns involving /sites, /drives, or /drive endpoints combined with search, directory traversal, and pagination parameters.
Microsoft Sentinel (KQL)
