TP: If you can confirm that strange routines, like significant-volume use of OneDrive workload, had been done from the application via Graph API. Sophisticated hunting table to be familiar with app activity and decide When the noticed behavior is anticipated. TP: When the app is unknow