Microsoft recommends correlating service-principal sign-ins with Graph exercise, listing adjustments and useful resource entry 8. Microsoft observed ARTEX accelerating scanning, reconnaissance, password spraying and OAuth utility abuse. A Number Of ARTEX-driven operations reached privileged cloud entry lower than three hours after initial focusing on. These tools work collectively to provide visibility, control, and speedy response