Threat Hunting with Microsoft Graph Activity Logs – SC-200 Study Guide

Purpose of This Lesson

Microsoft Graph activity logs provide an audit trail of activity involving requests to Microsoft Graph APIs. By sending these logs to an Azure monitoring destination—most commonly a Log Analytics workspace—a security analyst can query Microsoft 365 and Entra-related activity with Kusto Query Language (KQL).

This capability is especially useful when investigating web applications, SaaS integrations, automation, or other services that use Microsoft Graph to access Microsoft 365 resources. The central configuration path is Microsoft Entra ID → Diagnostic settings.

Key Concepts

Microsoft Graph

Microsoft Graph is Microsoft’s REST-based API layer for interacting with Microsoft 365 and related services, including Entra ID, Microsoft Teams, and Microsoft 365 workloads. Applications and services can use Graph to read or modify resources when they have the required permissions and consent.

Microsoft Graph activity logs

Graph activity logs record activity associated with requests made through Microsoft Graph. These records can help an analyst:

• Investigate suspicious application or service activity.
• Troubleshoot failed or unexpected Graph operations.
• Identify potentially compromised applications or identities.
• Hunt for unusual access to Microsoft 365 resources.
• Correlate Graph activity with other identity, endpoint, or cloud events.

These logs are particularly relevant when the suspicious behavior is performed by an application, automation account, or service rather than through an interactive user session.

Log destinations

Microsoft Graph activity logs can be sent to supported Azure destinations, including:

• A Log Analytics workspace.
• An Azure Storage account.
• An Azure Event Hubs namespace.

For interactive investigation and KQL queries, a Log Analytics workspace is the practical choice in this lesson.

Diagnostic settings

A diagnostic setting controls which logs are exported and where they are sent. In this scenario, the diagnostic setting is created in Microsoft Entra ID, with Microsoft Graph activity logs selected as the category and a Log Analytics workspace selected as the destination.

Creating a workspace alone does not collect Graph activity. The diagnostic setting is the step that enables the export.

Microsoft Security Operations Context

Graph activity logs complement—but do not replace—other Microsoft security telemetry:

• Microsoft Entra sign-in and audit logs help explain authentication and directory changes.
• Microsoft Defender XDR can correlate identity, endpoint, email, and cloud-app signals into incidents.
• Microsoft Sentinel can ingest and query exported data alongside other data sources.
• Defender for Cloud and application monitoring tools may provide additional context about workloads and integrations.

A SOC analyst might use Graph activity data when an investigation shows that an application, service principal, or automation process accessed Microsoft 365 resources unexpectedly. The analyst should then correlate the activity with identity permissions, consent changes, sign-in events, application ownership, and the time line of the incident.

Configuration Workflow

The high-level setup process is:

1. Confirm the required Microsoft Entra licensing, administrative permissions, and an Azure subscription.
2. Create or identify a Log Analytics workspace.
3. Open Microsoft Entra ID in the Azure portal.
4. Open Diagnostic settings.
5. Create a new diagnostic setting.
6. Select Microsoft Graph activity logs.
7. Select the Log Analytics workspace as the destination.
8. Save the diagnostic setting.
9. Open the Log Analytics workspace and select Logs to query the collected data.

The lesson also identifies Azure Storage and Event Hubs as supported log destinations. The exact destination should match the operational requirement: Log Analytics for direct KQL investigation, Storage for retention or downstream processing, and Event Hubs for streaming into another platform.

Prerequisites and operational considerations

The source lesson identifies the following prerequisites and considerations:

• A supported Microsoft Entra ID P1 or P2 licensing level.
• An administrator using a supported Microsoft Entra administrative role.
• An Azure subscription.
• A supported log destination, such as Log Analytics, Storage, or Event Hubs.
• Appropriate least-privilege permissions to configure the diagnostic setting.

Always verify current Microsoft documentation for the exact supported role and licensing requirements because Microsoft can change administrative role support and licensing details.

Exam-Relevant Takeaways

• The key configuration location is Microsoft Entra ID → Diagnostic settings.
• Select Microsoft Graph activity logs in the diagnostic setting.
• A Log Analytics workspace is the destination used for interactive KQL investigation in this workflow.
• Creating a Log Analytics workspace does not automatically populate it with Graph activity.
• Data availability depends on actual Graph activity in the tenant; an empty result does not necessarily indicate a configuration failure.
• Microsoft Graph activity logs are useful for investigating application and service-driven access to Microsoft 365.
• The lesson describes Log Analytics, Storage, and Event Hubs as possible destinations.
• Querying the data occurs from the Log Analytics workspace’s Logs experience.

Tool / Feature Decision Guide

Requirement	Appropriate choice	Reason
Run interactive KQL queries against Graph activity	Log Analytics workspace	Provides the Logs experience for investigation and hunting
Retain exported logs for storage or later processing	Azure Storage account	Provides a durable storage destination
Stream logs to another processing or security platform	Event Hubs	Designed as an event-streaming destination
Enable export of Graph activity	Microsoft Entra diagnostic setting	This is where the Graph activity log category is selected
Investigate an empty query result	Validate configuration and generate real Graph activity	Collection requires actual activity and may not be immediate

KQL Notes

The lesson points to Microsoft-provided example KQL queries for Microsoft Graph activity logs. The important exam skill is not memorizing a particular sample query; it is knowing where the data is collected and where to query it:

1. Export the logs through a Microsoft Entra diagnostic setting.
2. Send them to a Log Analytics workspace.
3. Open the workspace’s Logs blade.
4. Use the documented table and fields for the collected Graph activity data.

Microsoft’s sample queries should be checked against the current schema because table names and available fields can vary as the service evolves.

Common Exam Traps

• Confusing Graph activity logs with the Log Analytics workspace: The workspace stores and exposes the data, but the Entra diagnostic setting enables the export.
• Assuming workspace creation starts collection: It does not. A diagnostic setting and selected log category are required.
• Choosing Defender XDR automatically: Graph activity logging is configured through Microsoft Entra diagnostic settings; the best answer is not always a Defender portal feature.
• Assuming no results mean the configuration is broken: The tenant must generate relevant Graph activity, and ingestion may take time.
• Forgetting the destination requirement: Selecting the log category without selecting a supported destination does not complete the configuration.
• Treating Graph logs as a complete audit record for every Microsoft 365 action: They focus on activity through Microsoft Graph and should be correlated with other audit and security sources.
• Using excessive permissions: The configuration should use a supported least-privilege administrative role rather than broad tenant-wide access whenever possible.

Real-World SOC Analyst Notes

• Validate before troubleshooting: Confirm that the diagnostic setting is enabled, the Graph category is selected, and the intended destination is correct before concluding that data is missing.
• Expect sparse data in test tenants: A lab with little application or user activity may not produce useful records quickly. Do not manufacture suspicious conclusions from an empty or nearly empty dataset.
• Correlate identities and applications: When a Graph request looks suspicious, identify the calling application, service principal, user, or automation process and compare its behavior with its approved business purpose.
• Preserve evidence: Record the query, time range, relevant identifiers, configuration state, and exported results before changing permissions or deleting an application.
• Control tenant-wide impact: Diagnostic settings and administrative changes affect collection across the configured scope. Use change control and document the destination, retention, and expected cost.
• Consider data routing and retention: Storage and Event Hubs may support different downstream workflows, but they do not provide the same interactive investigation experience as Log Analytics.
• Avoid premature automation: Do not automatically disable an application or revoke consent solely because Graph activity is unusual. Confirm ownership, scope, and business impact, then escalate or contain according to incident procedures.

Quick Reference Summary

• What it is: An audit trail for activity involving Microsoft Graph requests.
• Why use it: To hunt for suspicious application, service, or identity-driven access to Microsoft 365.
• Where to configure it: Microsoft Entra ID → Diagnostic settings.
• What to select: Microsoft Graph activity logs.
• Best destination for KQL investigation: Log Analytics workspace.
• Other destinations covered: Azure Storage and Event Hubs.
• Where to query: The Log Analytics workspace’s Logs blade.
• Important limitation: Data may not appear until real Graph activity occurs and ingestion completes.

Flashcards

Q: Where do you enable collection of Microsoft Graph activity logs in the Azure portal?
A: In Microsoft Entra ID → Diagnostic settings. Select the Microsoft Graph activity log category and configure a supported destination.

Q: What is the role of a Log Analytics workspace in this workflow?
A: It is the destination that stores the exported Graph activity and provides the Logs experience for KQL queries. It does not enable collection by itself.

Q: A workspace exists, but Graph activity queries return no records. What should you check first?
A: Verify that an Entra diagnostic setting selects Microsoft Graph activity logs and sends them to that workspace. Then confirm that real Graph activity has occurred and allow for ingestion delay.

Q: Which destination should you choose for interactive KQL-based hunting?
A: Choose a Log Analytics workspace, because its Logs experience is designed for querying and investigation.

Q: When might Azure Storage be preferred over Log Analytics?
A: Storage may be preferred when the primary requirement is durable export, retention, or downstream processing rather than interactive KQL investigation.

Q: When might Event Hubs be preferred as a Graph activity destination?
A: Use Event Hubs when the logs need to be streamed to another processing or security platform.

Q: What type of activity is especially valuable to investigate with Microsoft Graph activity logs?
A: Application- or service-driven access to Microsoft 365 resources, especially when a service principal, automation process, or integration may be compromised or misused.

Q: How do Graph activity logs differ from Microsoft Entra audit or sign-in logs?
A: Graph activity logs focus on requests made through Microsoft Graph, while Entra audit and sign-in logs provide other identity and directory context. They should be correlated rather than treated as interchangeable.

Q: What prerequisite categories are identified for collecting Graph activity logs?
A: The lesson identifies supported Entra P1 or P2 licensing, a supported administrative role with appropriate permissions, an Azure subscription, and a supported log destination.

Q: What is the configuration mistake in selecting the Graph activity category but not a destination?
A: The export is incomplete. A diagnostic setting must send the selected logs to a supported destination such as Log Analytics, Storage, or Event Hubs.

Q: Where do you run queries after sending Graph activity to Log Analytics?
A: Open the Log Analytics workspace and select Logs. This is where KQL queries are run against the collected data.

Q: Why is an empty result not sufficient evidence that Graph activity logging is broken?
A: The tenant may not have generated relevant Graph activity, and ingestion can take time. Validate the diagnostic setting and test with genuine activity before troubleshooting further.

Q: What is the least-privilege consideration when configuring this capability?
A: Use a currently supported administrative role with only the permissions needed to configure the diagnostic setting and destination. Avoid granting broad tenant-wide privileges by default.

Practice Questions

Question 1

A SOC team wants to use KQL to investigate suspicious Microsoft Graph requests. The team has an Azure subscription but has not configured any log export. What should the analyst do first?

A. Open Microsoft Defender for Endpoint advanced hunting
B. Create an Entra diagnostic setting that selects Microsoft Graph activity logs
C. Create a Microsoft Sentinel analytics rule without a data connector
D. Enable an Azure Storage account and assume collection starts automatically

Correct answer: B

The Graph activity log category must be enabled through a Microsoft Entra diagnostic setting and routed to a supported destination. For KQL investigation, that destination would typically be a Log Analytics workspace.

Question 2

An organization needs to stream Microsoft Graph activity to an external event-processing system rather than investigate it interactively in Azure. Which destination best matches this requirement?

A. Event Hubs
B. Log Analytics only
C. An Entra sign-in report
D. Defender for Endpoint

Correct answer: A

Event Hubs is the streaming-oriented destination identified in the lesson. Log Analytics is the better fit for interactive KQL investigation.

Question 3

An analyst configured a Log Analytics workspace and a Graph activity diagnostic setting yesterday, but no records appear. The tenant has very little application activity. What is the best next step?

A. Conclude that the diagnostic setting is defective
B. Delete and recreate the Azure subscription
C. Verify the selected category and destination, then generate or wait for genuine Graph activity
D. Replace the workspace with Defender for Endpoint

Correct answer: C

Graph activity must actually occur, and ingestion may not be immediate. The analyst should validate the configuration before treating the lack of data as a service failure.

Question 4

During an investigation, an application appears to have accessed Microsoft 365 resources through Graph in an unusual way. Which approach provides the strongest analysis?

A. Review Graph activity in isolation and immediately disable the application
B. Correlate Graph activity with Entra identity data, application ownership, permissions, and related security alerts
C. Ignore the event because Graph activity is always expected
D. Search only endpoint process telemetry

Correct answer: B

Graph activity can identify suspicious API use, but identity context, permissions, ownership, and related alerts are needed to distinguish compromise from approved automation and to choose a safe response.

Question 5

Which statement about a Log Analytics workspace is correct?

A. Creating it automatically collects all Microsoft Graph activity
B. It is the portal location where the diagnostic setting is configured in Entra ID
C. It stores routed Graph activity and provides the Logs experience for KQL queries
D. It replaces the need for Microsoft Entra licensing and permissions

Correct answer: C

The workspace is the collection and query destination. Collection still requires the appropriate Entra diagnostic setting, licensing, permissions, and actual Graph activity.