Microsoft says app-governance threat detection counts activities using transient data that may not be stored. An alert can therefore report a count or spike without including every related activity. For OAuth applications’ Microsoft Graph calls, the tenant can audit the activities through Log Analytics and Sentinel. The documented detections are nondeterministic and depend on behavior departing from the norm. Microsoft Learn.
\nIdentify the app-governance alert, application and interval under investigation. Determine which activity logging was actually available for that interval; the documentation does not establish that it was configured in your tenant. Keep the alert’s aggregate observation distinct from individually retrievable calls and from an analyst’s conclusion.
\nPreserve the alert’s aggregate indication and collect available activity records as separate evidence sources. Have the application owner explain expected activity while the responder examines the recorded calls, permissions and relevant changes. Mark missing underlying records as an evidence limitation rather than inventing a transaction list from the displayed count. For future investigations, review the tenant’s Graph activity-audit coverage and access with the logging owner.
\nCompare the alert’s time and application identity with the available audit records, noting differences in coverage instead of forcing their totals to agree. Document which conclusions are supported by individual events and which rely only on the aggregate detection. In a controlled readiness exercise, verify that authorized responders can retrieve expected Graph activity through the configured logging path. Do not use the absence of a reproducible alert as a test of whether those records were retained.
\nMicrosoft Learn: Investigate OAuth app threat detection alerts. Source reviewed September 9, 2026.
", "content_text": "Source facts\nMicrosoft says app-governance threat detection counts activities using transient data that may not be stored. An alert can therefore report a count or spike without including every related activity. For OAuth applications’ Microsoft Graph calls, the tenant can audit the activities through Log Analytics and Sentinel. The documented detections are nondeterministic and depend on behavior departing from the norm. Microsoft Learn.\nApplicability\nIdentify the app-governance alert, application and interval under investigation. Determine which activity logging was actually available for that interval; the documentation does not establish that it was configured in your tenant. Keep the alert’s aggregate observation distinct from individually retrievable calls and from an analyst’s conclusion.\nDSE recommendation\nPreserve the alert’s aggregate indication and collect available activity records as separate evidence sources. Have the application owner explain expected activity while the responder examines the recorded calls, permissions and relevant changes. Mark missing underlying records as an evidence limitation rather than inventing a transaction list from the displayed count. For future investigations, review the tenant’s Graph activity-audit coverage and access with the logging owner.\nVerification\nCompare the alert’s time and application identity with the available audit records, noting differences in coverage instead of forcing their totals to agree. Document which conclusions are supported by individual events and which rely only on the aggregate detection. In a controlled readiness exercise, verify that authorized responders can retrieve expected Graph activity through the configured logging path. Do not use the absence of a reproducible alert as a test of whether those records were retained.\nOfficial references\nMicrosoft Learn: Investigate OAuth app threat detection alerts. Source reviewed September 9, 2026.", "content_markdown": "## Source facts\n\nMicrosoft says app-governance threat detection counts activities using transient data that may not be stored. An alert can therefore report a count or spike without including every related activity. For OAuth applications’ Microsoft Graph calls, the tenant can audit the activities through Log Analytics and Sentinel. The documented detections are nondeterministic and depend on behavior departing from the norm. [Microsoft Learn](https://learn.microsoft.com/en-us/defender-cloud-apps/app-governance-anomaly-detection-alerts).\n\n## Applicability\n\nIdentify the app-governance alert, application and interval under investigation. Determine which activity logging was actually available for that interval; the documentation does not establish that it was configured in your tenant. Keep the alert’s aggregate observation distinct from individually retrievable calls and from an analyst’s conclusion.\n\n## DSE recommendation\n\nPreserve the alert’s aggregate indication and collect available activity records as separate evidence sources. Have the application owner explain expected activity while the responder examines the recorded calls, permissions and relevant changes. Mark missing underlying records as an evidence limitation rather than inventing a transaction list from the displayed count. For future investigations, review the tenant’s Graph activity-audit coverage and access with the logging owner.\n\n## Verification\n\nCompare the alert’s time and application identity with the available audit records, noting differences in coverage instead of forcing their totals to agree. Document which conclusions are supported by individual events and which rely only on the aggregate detection. In a controlled readiness exercise, verify that authorized responders can retrieve expected Graph activity through the configured logging path. Do not use the absence of a reproducible alert as a test of whether those records were retained.\n\n## Official references\n\n[Microsoft Learn: Investigate OAuth app threat detection alerts](https://learn.microsoft.com/en-us/defender-cloud-apps/app-governance-anomaly-detection-alerts). Source reviewed September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-302-do-not-treat-an-app-governance-activity-count-as-a-retained-graph-audit-trail/", "url": "https://update.dsesecurity.com/updates/dse-20260909-302-do-not-treat-an-app-governance-activity-count-as-a-retained-graph-audit-trail/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-302-do-not-treat-an-app-governance-activity-count-as-a-retained-graph-audit-trail/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Do not treat an app-governance activity count as a retained Graph audit trail", "item": "https://update.dsesecurity.com/updates/dse-20260909-302-do-not-treat-an-app-governance-activity-count-as-a-retained-graph-audit-trail/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-302-do-not-treat-an-app-governance-activity-count-as-a-retained-graph-audit-trail/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-302-do-not-treat-an-app-governance-activity-count-as-a-retained-graph-audit-trail/", "url": "https://update.dsesecurity.com/updates/dse-20260909-302-do-not-treat-an-app-governance-activity-count-as-a-retained-graph-audit-trail/", "headline": "Do not treat an app-governance activity count as a retained Graph audit trail", "description": "Why might an OAuth threat alert show a spike without containing every underlying API activity?", "abstract": "Why might an OAuth threat alert show a spike without containing every underlying API activity?", "articleBody": "Source facts\nMicrosoft says app-governance threat detection counts activities using transient data that may not be stored. An alert can therefore report a count or spike without including every related activity. For OAuth applications’ Microsoft Graph calls, the tenant can audit the activities through Log Analytics and Sentinel. The documented detections are nondeterministic and depend on behavior departing from the norm. Microsoft Learn.\nApplicability\nIdentify the app-governance alert, application and interval under investigation. Determine which activity logging was actually available for that interval; the documentation does not establish that it was configured in your tenant. Keep the alert’s aggregate observation distinct from individually retrievable calls and from an analyst’s conclusion.\nDSE recommendation\nPreserve the alert’s aggregate indication and collect available activity records as separate evidence sources. Have the application owner explain expected activity while the responder examines the recorded calls, permissions and relevant changes. Mark missing underlying records as an evidence limitation rather than inventing a transaction list from the displayed count. For future investigations, review the tenant’s Graph activity-audit coverage and access with the logging owner.\nVerification\nCompare the alert’s time and application identity with the available audit records, noting differences in coverage instead of forcing their totals to agree. Document which conclusions are supported by individual events and which rely only on the aggregate detection. In a controlled readiness exercise, verify that authorized responders can retrieve expected Graph activity through the configured logging path. Do not use the absence of a reproducible alert as a test of whether those records were retained.\nOfficial references\nMicrosoft Learn: Investigate OAuth app threat detection alerts. Source reviewed September 9, 2026.", "datePublished": "2026-09-10T00:26:54+00:00", "dateModified": "2026-09-10T01:40:02+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-302-do-not-treat-an-app-governance-activity-count-as-a-retained-graph-audit-trail/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-302-do-not-treat-an-app-governance-activity-count-as-a-retained-graph-audit-trail/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Do not treat an app-governance activity count as a retained Graph audit trail" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 267, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Investigate OAuth app threat detection alerts with app governance - Microsoft Defender for Cloud Apps | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/defender-cloud-apps/app-governance-anomaly-detection-alerts" } } ] } }