Alerts related to data source "Microsoft Graph Logs".
An Azure application reached a throttling API rate
An Azure identity performed multiple actions that were denied
Attempted Azure application access from unknown tenant
Authentication method was added to Azure account
Azure conditional access policy creation or modification
Azure enumeration activity using Microsoft Graph API
Azure group creation/deletion
Azure mailbox rule creation
Azure Privilege Escalation Using an Application
Azure Service principal/Application creation
Azure user creation/deletion
Azure user password reset
Cloud penetration testing tool activity
Credentials were added to Azure application
External user invitation to Azure tenant
Mailbox enumeration activity by Azure application
Microsoft 365 storage services exfiltration activity
Microsoft OneDrive enumeration activity
Microsoft OneNote enumeration activity
Microsoft SharePoint enumeration activity
Microsoft Teams enumeration activity
OneDrive file download
OneDrive file upload
OneDrive folder creation
Owner was added to Azure application
Possible Insider Threat Activity
Possible phishing attack via Microsoft Teams
Potential extraction of NAA Account Credentials in Microsoft Configuration Manager
Privileged role used by Azure application
Suspicious Azure enumeration activity
Uncommon increase in Azure Microsoft Graph API request sizes
Unusual access to Microsoft 365 storage services
Unusual resource access by Azure application
User installed an application in Microsoft Teams via Graph API
User sent messages in Microsoft Teams to multiple conversations via Graph API
Was this helpful?
