> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/microsoft-graph-logs.md).

# Microsoft Graph Logs

Alerts related to data source "Microsoft Graph Logs".

| Alert                                                                                                                                                                                                        |
| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| [An Azure application reached a throttling API rate](/analytics-alerts/alerts-by-name/an-azure-application-reached-a-throttling-api-rate.md)                                                                 |
| [An Azure identity performed multiple actions that were denied](/analytics-alerts/alerts-by-name/an-azure-identity-performed-multiple-actions-that-were-denied.md)                                           |
| [Attempted Azure application access from unknown tenant](/analytics-alerts/alerts-by-name/attempted-azure-application-access-from-unknown-tenant.md)                                                         |
| [Authentication method was added to Azure account](/analytics-alerts/alerts-by-name/authentication-method-was-added-to-azure-account.md)                                                                     |
| [Azure conditional access policy creation or modification](/analytics-alerts/alerts-by-name/azure-conditional-access-policy-creation-or-modification.md)                                                     |
| [Azure enumeration activity using Microsoft Graph API](/analytics-alerts/alerts-by-name/azure-enumeration-activity-using-microsoft-graph-api.md)                                                             |
| [Azure group creation/deletion](/analytics-alerts/alerts-by-name/azure-group-creation-deletion.md)                                                                                                           |
| [Azure mailbox rule creation](/analytics-alerts/alerts-by-name/azure-mailbox-rule-creation.md)                                                                                                               |
| [Azure Privilege Escalation Using an Application](/analytics-alerts/alerts-by-name/azure-privilege-escalation-using-an-application.md)                                                                       |
| [Azure Service principal/Application creation](/analytics-alerts/alerts-by-name/azure-service-principal-application-creation.md)                                                                             |
| [Azure user creation/deletion](/analytics-alerts/alerts-by-name/azure-user-creation-deletion.md)                                                                                                             |
| [Azure user password reset](/analytics-alerts/alerts-by-name/azure-user-password-reset.md)                                                                                                                   |
| [Cloud penetration testing tool activity](/analytics-alerts/alerts-by-name/cloud-penetration-testing-tool-activity.md)                                                                                       |
| [Credentials were added to Azure application](/analytics-alerts/alerts-by-name/credentials-were-added-to-azure-application.md)                                                                               |
| [External user invitation to Azure tenant](/analytics-alerts/alerts-by-name/external-user-invitation-to-azure-tenant.md)                                                                                     |
| [Mailbox enumeration activity by Azure application](/analytics-alerts/alerts-by-name/mailbox-enumeration-activity-by-azure-application.md)                                                                   |
| [Microsoft 365 storage services exfiltration activity](/analytics-alerts/alerts-by-name/microsoft-365-storage-services-exfiltration-activity.md)                                                             |
| [Microsoft OneDrive enumeration activity](/analytics-alerts/alerts-by-name/microsoft-onedrive-enumeration-activity.md)                                                                                       |
| [Microsoft OneNote enumeration activity](/analytics-alerts/alerts-by-name/microsoft-onenote-enumeration-activity.md)                                                                                         |
| [Microsoft SharePoint enumeration activity](/analytics-alerts/alerts-by-name/microsoft-sharepoint-enumeration-activity.md)                                                                                   |
| [Microsoft Teams enumeration activity](/analytics-alerts/alerts-by-name/microsoft-teams-enumeration-activity.md)                                                                                             |
| [OneDrive file download](/analytics-alerts/alerts-by-name/onedrive-file-download.md)                                                                                                                         |
| [OneDrive file upload](/analytics-alerts/alerts-by-name/onedrive-file-upload.md)                                                                                                                             |
| [OneDrive folder creation](/analytics-alerts/alerts-by-name/onedrive-folder-creation.md)                                                                                                                     |
| [Owner was added to Azure application](/analytics-alerts/alerts-by-name/owner-was-added-to-azure-application.md)                                                                                             |
| [Possible Insider Threat Activity](/analytics-alerts/alerts-by-name/possible-insider-threat-activity.md)                                                                                                     |
| [Possible phishing attack via Microsoft Teams](/analytics-alerts/alerts-by-name/possible-phishing-attack-via-microsoft-teams.md)                                                                             |
| [Potential extraction of NAA Account Credentials in Microsoft Configuration Manager](/analytics-alerts/alerts-by-name/potential-extraction-of-naa-account-credentials-in-microsoft-configuration-manager.md) |
| [Privileged role used by Azure application](/analytics-alerts/alerts-by-name/privileged-role-used-by-azure-application.md)                                                                                   |
| [Suspicious Azure enumeration activity](/analytics-alerts/alerts-by-name/suspicious-azure-enumeration-activity.md)                                                                                           |
| [Uncommon increase in Azure Microsoft Graph API request sizes](/analytics-alerts/alerts-by-name/uncommon-increase-in-azure-microsoft-graph-api-request-sizes.md)                                             |
| [Unusual access to Microsoft 365 storage services](/analytics-alerts/alerts-by-name/unusual-access-to-microsoft-365-storage-services.md)                                                                     |
| [Unusual resource access by Azure application](/analytics-alerts/alerts-by-name/unusual-resource-access-by-azure-application.md)                                                                             |
| [User installed an application in Microsoft Teams via Graph API](/analytics-alerts/alerts-by-name/user-installed-an-application-in-microsoft-teams-via-graph-api.md)                                         |
| [User sent messages in Microsoft Teams to multiple conversations via Graph API](/analytics-alerts/alerts-by-name/user-sent-messages-in-microsoft-teams-to-multiple-conversations-via-graph-api.md)           |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/microsoft-graph-logs.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.