Microsoft Graph API abuse