The AADGraphActivityLogs are available! For years, defenders have been left in the dark when it comes to attackers abusing the Azure Active Directory Graph.

The wait has been finaly over, and defenders can now use these logs to detect the usage of AADInternals, ROADtools and others.

Schema reference: https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/aadgraphactivitylogs