An ES|QL rule that detects Microsoft Graph app-only directory reconnaissance by identifying requests to at least three directory collections (applications, service principals, users, groups, directory roles, role assignments, and OAuth permission grants) within a 15-minute window that include at least one HTTP 403 response. The rule uses Azure Graph Activity Logs (logs-azure.graphactivitylogs) to aggregate requests by tenant and service principal, requiring the app_id and service_principal_id to be present. The denial of access (403) helps distinguish discovery attempts from legitimate inventory queries. When triggered, the alert surfaces the tenant, service principal, time window, targeted paths, status codes, source IPs, and involved app IDs. It is mapped to MITRE ATT&CK Discovery techniques (T1069 Cloud Groups and T1087 Cloud Account) and is designed to catch adversaries with compromised application credentials seeking privileged identity information, while attempting to reduce noise from authorized inventory activity via the denial condition.