Azure AD Graph Activity Logs: Ingestion and threat detection to close the visibility gap

This Elastic Security Labs report explains that Azure AD Graph Activity Logs (AzureADGraphActivityLogs) are now ingestible into Elastic, closing a long-standing visibility gap that adversary tooling like ROADrecon and AADInternals exploited; it details ingestion steps, field mappings (ECS fields), sample recon behavior, detection rules (user-agent fingerprints, high 4xx ratios, unusual client/user pairs, ASN anomalies, ROADrecon bursts, device-code sequences), and mitigation options such as per-app blockAzureADGraphAccess, Conditional Access, and auditing application registrations.