Detects a successful non-interactive Microsoft Entra ID (Azure AD) sign-in on a managed, Azure AD joined device whose exact sign-in token identifier is later used by a scripted Microsoft Graph query to enumerate directory resources across at least three distinct Graph endpoints. The rule correlates the sign-in token (azure.signinlogs.properties.unique_token_identifier) with Graph activity (token.id) rather than relying on the session identifier alone. It normalizes token, session, user, app, and device identifiers and filters for a non-interactive sign-in from a managed, Azure AD joined device using a refresh token or PRT, targeting the Graph resource, with Edge as the user agent for the sign-in. It then identifies scripted Graph enumeration activity by user agents associated with PowerShell, Python requests, curl, and other scripting clients, and constrains the Graph read requests to common endpoints such as /v1.0/users, /beta/users, /v1.0/groups, /beta/groups, /v1.0/devices, /beta/devices, /v1.0/directoryroles, /beta/directoryroles, /v1.0/organization, /beta/organization, /v1.0/subscribedskus, /beta/subscribedskus, and similar role/definition endpoints, requiring at least three distinct url.path entries. Events are aggregated by token, session, user, app, device, and tenant, and a match is emitted when both a client sign-in and a scripted Graph enumeration occur within the window, with the scripted event timestamp not preceding the sign-in. The rule supports triage with pivoting on related fields and disseminates MITRE ATT&CK mappings to T1087 (Cloud Account), T1526 (Cloud Service Discovery), and T1550.001 (Application Access Token) under Discovery and Defense Evasion. Guidance covers false positives, enrichment steps, and remediation actions such as revoking sessions/tokens, reviewing associated Graph activity, and tightening conditional access and token protections.