Classify the alert as being a Fake favourable and consider sharing feed-back based on your investigation in the alert.This detection identifies when an app consented to suspicious OAuth scope and made a substantial volume of unconventional e mail lookup activities, like e mail search for unique written content with the Graph API.You might know Fitb