Defender XDR Alert: Suspicious Exchange Online Graph Reconnaissance Activity

How Microsoft Defender XDR Detects Directory Enumeration — and What Your Team Should Do Next

The most dangerous phase of a Microsoft 365 attack is often the quietest one.

Across higher education, K–12, and state and local government, we’re seeing threat actors move away from noisy, smash-and-grab attacks toward something more patient: identity-based reconnaissance. Rather than deploying malware on day one, attackers who gain access to an account spend their first hours quietly figuring out who matters in your organization — who runs payroll, who approves invoices, who holds Global Administrator rights — before launching business email compromise (BEC), credential theft, or invoice fraud campaigns.

The good news: this behavior leaves fingerprints. Microsoft Defender XDR can detect it by flagging Microsoft Graph API queries that look like directory harvesting rather than legitimate administrative activity.

Here’s how the alert works, why it matters for mission-driven organizations, and the steps your team can take when it fires.

What Does the Alert Detect?

This Defender XDR alert identifies unusual Microsoft Graph API directory searches — queries that appear to be gathering intelligence on privileged users instead of performing routine lookups.

A legitimate lookup searches for a specific person. Reconnaissance looks different: bulk Graph API requests against the /users endpoint using the $search parameter to sweep for anyone associated with sensitive departments or job functions.

Common characteristics include:

• Multiple role- or department-related keywords chained together with OR statements
• Searches spanning several identity attributes at once — Display Name, Given Name, Surname, Job Title, Email Address, and User Principal Name (UPN)
• Large page sizes ($top=999, or near the platform limit)
• Requests originating from unfamiliar applications or unusual geographic locations
• OAuth applications holding permissions well beyond what a directory search requires

The goal isn’t to find one employee. It’s to rapidly map your entire org chart and pinpoint the people with financial or administrative authority.

What Suspicious Activity Looks Like in Practice

In one observed example, Defender XDR flagged a Graph API request to GET /users that searched for the terms Payroll, HR, Finance, Support, Admin, and Information — across multiple identity fields, while requesting nearly the maximum number of returned users.

Several additional indicators raised the risk score:

• The application held broad Graph permissions, including Mail, Files, User.Invite.All, and OnlineMeetings
• The request originated from an unusual geographic location
• The Application ID wasn’t recognized as an approved enterprise application

Any one of these behaviors could be legitimate on its own. Together, they paint a picture consistent with directory reconnaissance following an account compromise — and that combination is exactly what behavioral analytics are built to catch.

Why This Alert Matters

Directory reconnaissance is frequently one of the first observable actions after an attacker gains access to a Microsoft 365 account. Before making a move, threat actors want to know:

• Who approves invoices
• Who processes payroll
• Which users hold Global Administrator privileges
• Which executives can authorize payments
• Which IT staff can reset passwords or grant access

That intelligence is what turns a generic phishing email into a convincing, targeted one. It’s the difference between a spam message your users delete and a payroll diversion request that looks like it came from your CFO.

For colleges and universities, K–12 districts, municipalities, and state agencies, the stakes are especially clear. Successful reconnaissance can expose the people responsible for Student Information Systems, Financial Aid, Human Resources, Payroll, Procurement, Technology Services, and executive leadership — the exact roles attackers target for fraud.

And because these searches run through the Microsoft Graph API rather than the Microsoft 365 portal, they blend into normal cloud activity unless behavioral analytics are watching for suspicious query patterns.

MITRE ATT&CK Mapping

This activity commonly aligns with:

• T1087.003 – Account Discovery: Email Account
• T1087.004 – Account Discovery: Cloud Account

Both techniques appear during the Discovery phase of an intrusion — before attackers move on to credential theft, mailbox manipulation, lateral movement, or fraudulent email activity. Catching them here means catching the attack early.

How to Investigate

When this alert fires, the core question is simple: is this legitimate administration, or malicious reconnaissance? A structured investigation gets you to an answer quickly.

1. Identify the User

Resolve the Account Object ID in Microsoft Entra ID and ask:

• Does this user’s role normally require Graph API searches?
• Has the account recently shown unusual behavior?
• Is the activity consistent with their previous login patterns?

2. Validate the Application

Review the Application ID behind the request:

• Is the application sanctioned by IT?
• Was it recently registered?
• Has it accessed Microsoft Graph before?
• Does it belong to a trusted vendor?

Unknown applications deserve immediate attention.

3. Review Microsoft Graph Permissions

Inspect the OAuth permissions granted to the application, and look for anything excessive or unnecessary:

• Mail.ReadWrite
• Files.ReadWrite.All
• User.Invite.All
• Mail.Send
• Directory.ReadWrite.All

Applications should operate with least-privilege access. A “directory search” app holding mailbox write permissions is a red flag.

4. Examine Sign-In Activity

Pivot into Microsoft Entra ID Sign-in Logs, Entra ID Protection, and the Defender XDR timeline. Review for:

• Impossible travel
• New countries or IP addresses
• Anonymous VPN usage
• High-risk sign-ins
• Suspicious devices
• Recent OAuth consent grants

5. Hunt for Follow-On Activity

Finally, determine whether reconnaissance has already progressed into something more. Search for:

• New mailbox forwarding or inbox rules
• SendMail activity and SendAs permissions
• Unusual mailbox reads
• Guest account creation
• MFA changes or password resets
• Privilege escalation

Finding any of these significantly increases confidence that the account is compromised — and shifts the response from investigation to containment.

Remediation: Move Quickly, Contain Fully

If malicious activity is confirmed, speed matters. Recommended actions include:

• Disable the compromised account
• Revoke active sessions and refresh tokens
• Force a password reset and require MFA re-registration
• Remove unauthorized mailbox rules and forwarding rules
• Remove unauthorized guest accounts
• Revoke OAuth consent and disable or delete malicious app registrations
• Notify Payroll, HR, Finance, Procurement, and executive leadership of potential follow-on phishing attempts

That last step is easy to overlook, but it’s one of the most important. Reconnaissance exists to set up the next attack — warning the departments most likely to be targeted can stop a fraud attempt before it starts.

Reducing Your Exposure Going Forward

The best version of this alert is the one that never fires. A few Microsoft 365 security controls go a long way toward shrinking the attack surface.

Enforce strong application governance. Require administrator approval for high-risk Microsoft Graph permissions, review Enterprise Applications regularly for permission creep, remove unused OAuth applications, and monitor newly registered apps.

Apply least-privilege access. Limit applications to Directory.Read.All where possible, restrict mailbox access through Application Access Policies, and periodically review privileged Graph permissions.

Strengthen identity security. Multi-Factor Authentication, Conditional Access policies, compliant device requirements, risk-based sign-in policies, and Continuous Access Evaluation (CAE) all reduce the odds that stolen credentials can be used at all.

Train your high-risk departments. Payroll, HR, Finance, Procurement, and executive assistants remain the most common BEC targets. Focus security awareness training on invoice fraud, payroll diversion, executive impersonation, MFA fatigue attacks, and OAuth consent phishing.

How Guardian 365 Helps

For most education and government IT teams, the challenge isn’t understanding these steps — it’s having the time and staffing to run them 24/7. Alerts like this one arrive at 2 a.m. on a Saturday just as often as they do during business hours.

That’s where Guardian 365 comes in. Our Microsoft-verified MXDR service monitors your Microsoft 365, Entra ID, and Defender XDR environment around the clock, triages alerts like this one, runs the investigation, and contains confirmed threats — so reconnaissance never gets the chance to become fraud. We make security easy, because your mission is too important for security to get in the way.

Not sure how your tenant would hold up against directory reconnaissance? A Guardian 365 Data Security Assessment is a low-pressure way to find out. We’ll review your application governance, identity protections, and detection coverage, and give you a clear, prioritized picture of where you stand.