oauth delegated access

Microsoft Entra ID agent logs are becoming a practical threat-hunting source in June 2026 because assistive AI agents can use delegated OAuth access to act for signed-in users, making malicious Graph and Exchange activity look deceptively human. The uncomfortable lesson is that “on behalf of” is...