TP: If you can ensure that unconventional activities, for example higher-volume use of OneDrive workload, have been executed through the app by means of Graph API.Advisable Motion: Classify the alert to be a Wrong positive and take into account sharing suggestions based upon your investigation of the alert.Recommended action: Evaluate the Reply URL