Post

🚀🔎 Track Sensitive Graph API Calls with my new #KQL Function for #MicrosoftDefenderXDR Microsoft has released the new advanced hunting table "GraphAPIAuditEvents" which offers great opportunities to investigate activities based on #MicrosoftGraph API calls.

Thomas Naunheim

@naunheim.cloud

17 July 2025

I've created an experimental KQL function that enriches the data with details from #ExposureManagement and #EntraOps. This might help identify sensitive Graph Calls from the large volume of events in this table. 🔗 The query is available here: github.com/Cloud-Archit...

In the following example, several indicators are included that make this particular call interesting for further investigation: 1. IsSensitiveCaller 🗣️ A regular enterprise user (based on Exposure Management Critical Asset information) is calling Graph.

Thomas Naunheim

@naunheim.cloud

17 July 2025

2. IsHighSensitiveScope 🔑 However, the scope includes Application.ReadWrite.All, which has been identified as "Control Plane" by using EntraOps classification model.

Thomas Naunheim

@naunheim.cloud

3. IsSensitiveAction ▶️ The Graph request includes a POST to the servicePrincipal endpoint, which is flagged as a sensitive modification. This logic is experimental and simplified, so it may result in inaccurate classification and should be used in combo with others indicators.

17/7/25, 6:43 am0 reposts0 likes

Thomas Naunheim

@naunheim.cloud

17 July 2025

4. IsSensitiveTarget 🎯 The modified object is classified as critical (based on Exposure Management Critical Assets), and the applied rule details are displayed. In this case, the service principal has been assigned critical app permissions in Exchange Online.