Data Source: Azure AD Graph

Azure AD Graph Access with Unusual User and ASN

Jun 25, 2026 · Domain: Cloud Data Source: Azure Data Source: Azure AD Graph Data Source: Azure AD Graph Activity Logs Use Case: Identity and Access Audit Use Case: Threat Detection Tactic: Initial Access Resources: Investigation Guide ·

Share on:

Identifies Azure AD Graph (graph.windows.net) requests originating from network sources outside the major public-cloud and Microsoft ASNs that legitimate first-party callers normally come from. Adversary tooling typically rides on commodity hosting (residential ISPs, VPS providers, anonymisers) which produces an ASN distribution very different from the Microsoft / AWS / GCP / Akamai / Cloudflare ranges that dominate legitimate AAD Graph traffic.

Azure AD Graph Access with Unusual Client and User

Jun 22, 2026 · Domain: Cloud Data Source: Azure Data Source: Azure AD Graph Data Source: Azure AD Graph Activity Logs Use Case: Threat Detection Tactic: Defense Evasion Tactic: Discovery Resources: Investigation Guide ·

Share on:

Identifies Azure AD Graph (graph.windows.net) requests where the combination of calling OAuth client ("azure.aadgraphactivitylogs.properties.app_id") and signed-in user ("user.id") has not been observed in the tenant in a historical window. A user appearing against AAD Graph under an OAuth client that has not previously authenticated that user is a sign of a FOCI swap, a phished refresh token being redeemed for a new client, or an adversary running tooling under a client identity the user does not normally use.

Azure AD Graph High 4xx Error Ratio from User

Jun 22, 2026 · Domain: Cloud Data Source: Azure Data Source: Azure AD Graph Data Source: Azure AD Graph Activity Logs Use Case: Threat Detection Tactic: Discovery Resources: Investigation Guide ·

Share on:

Detects an unusually high ratio of 4xx HTTP responses from Azure AD Graph (graph.windows.net) per calling identity in a short window. Post-identity compromise leading to recon often leaves a tail of 403s and 404s as tooling walks endpoints it does not have permission for, asks for object IDs it does not have, or uses an OAuth client that has been pulled off the AAD Graph allow-list. Surges or an unexpected ratio of 4xx responses concentrated on a single (user and ASN) pair are characteristic of automated tooling rather than human or first-party traffic.

Azure AD Graph Access with Suspicious User-Agent

Jun 20, 2026 · Domain: Cloud Data Source: Azure Data Source: Azure AD Graph Data Source: Azure AD Graph Activity Logs Use Case: Threat Detection Tactic: Discovery Resources: Investigation Guide ·

Share on:

Identifies Azure AD Graph (graph.windows.net) requests originating from user-agent strings associated with offensive tooling, scripting libraries, or generic HTTP clients. First-party Microsoft components calling AAD Graph identify with specific user agents such as "Microsoft Azure Graph Client Library", "Microsoft ADO.NET Data Services", or "Microsoft.OData.Client". Anything outside that recognised set is either a developer prototyping against the legacy API or an enumeration tool walking the directory.

Entra ID OAuth Device Code Sign-in to Azure AD Graph Enumeration

Jun 18, 2026 · Domain: Cloud Domain: Identity Data Source: Azure Data Source: Microsoft Entra ID Data Source: Microsoft Entra ID Sign-in Logs Data Source: Azure AD Graph Data Source: Azure AD Graph Activity Logs Use Case: Identity and Access Audit Use Case: Threat Detection Tactic: Credential Access Tactic: Initial Access Tactic: Discovery Resources: Investigation Guide ·

Share on:

Correlates a successful Entra ID device-code sign-in to the legacy Azure AD Graph audience (00000002-0000-0000-c000-000000000000) from an unmanaged device with directory enumeration against graph.windows.net by the same user within a short window. Device-code phishing is the dominant OAuth phishing variant against Microsoft tenants: the adversary initiates the flow, relays the user-facing code to the victim, and on redemption walks away with an access or refresh token bound to the targeted resource without ever handling the user's password or MFA factor. When the redeemed audience is AAD Graph and the redeeming device is unmanaged, the follow-on Graph traffic is the compromised cloud account being used by the attacker, not by the user. This rule fires when that token is immediately turned around against the directory under the same identity to read user, group, service principal, application, role assignment, directory object, policy, OAuth permission grant, or tenant detail collections.

Azure AD Graph Potential Enumeration (ROADrecon)

Jun 17, 2026 · Domain: Cloud Data Source: Azure Data Source: Azure AD Graph Data Source: Azure AD Graph Activity Logs Use Case: Threat Detection Tactic: Discovery Resources: Investigation Guide ·

Share on:

Detects an Azure AD Graph (graph.windows.net) burst from a user-agent identifying as "aiohttp" (the default HTTP library used by ROADrecon's "gather" command) where a single calling identity issues many requests in a short window. ROADrecon walks every interesting directory object type via aiohttp, producing a large volume of requests from one user / source IP / UA triple. The combination of "aiohttp" UA with a burst threshold is a structural ROADrecon signature; legitimate first-party Microsoft components do not identify as aiohttp.