Microsoft Graph

Using a valid Microsoft Graph access token, enumerate directory resources visible to the identity (cloud service discovery), or read messages from a mailbox when the token's permissions authorize access (remote email collection). These are distinct operations; directory enumeration does not authorize mailbox access or establish that a service principal is privileged.