This detection identifies that an Application consented to higher privilege scope, creates suspicious inbox rule and created a high volume of vital mail read actions by means of Graph API. A non-Microsoft cloud app created anomalous Graph API phone calls to OneDrive, which include superior-volume info use. Detected by https://edwardb888eqk8.wannawiki.com/user