Unusual access to Microsoft 365 storage services

Cortex XDR Analytics Alert Reference by Alert name

Product

Cortex XDR

Last date published

2025-06-24

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	5 Days
Required Data	Requires one of the following data sources: Azure Audit Log OR Microsoft Graph Logs
Detection Modules	Cloud
Detector Tags	Microsoft Graph Activity Logs
ATT&CK Tactic	Discovery (TA0007)
ATT&CK Technique	Cloud Service Discovery (T1526)
Severity	Informational

Unusual access was detected to a Microsoft 365 storage service.

Extract sensitive information stored in Microsoft 365 storage services.

Determine which items were accessed.
Identify whether they contained any sensitive information.
Check for signs of compromise identity, such as abnormal login activity or unusual behavior.
Verify if the identity is authorized to access these drives.
Monitor the identity for any further suspicious actions.

Unusual access was detected to a Microsoft 365 storage service.

Extract sensitive information stored in Microsoft 365 storage services.

Determine which items were accessed.
Identify whether they contained any sensitive information.
Check for signs of compromise identity, such as abnormal login activity or unusual behavior.
Verify if the identity is authorized to access these drives.
Monitor the identity for any further suspicious actions.