App Granted Microsoft Permissions — Detection Rule

Detects when an application is granted delegated or app role permissions for Microsoft Graph, Exchange, Sharepoint, or Azure AD

Read the full analysis on IntelFusions