Azure Active Directory (Azure AD) Identity Protection is the appropriate tool for monitoring potentially compromised user accounts. It specializes in detecting and remediating identity-based risks by analyzing signals like atypical travel, sign-ins from anonymous IP addresses, and leaked credentials found on the dark web. It calculates a user risk level, allowing administrators to identify and respond to compromised accounts swiftly.

Microsoft Defender for Cloud Apps is a Cloud Access Security Broker (CASB) designed to provide visibility and control over cloud applications. It includes built-in anomaly detection policies that can identify unusual user activities. One of these default policies is "Mass download by a single user," which is specifically designed to detect and alert on the exact scenario of users performing bulk file downloads from connected apps like SharePoint Online.

Microsoft Entra documentation | What is Identity Protection?

Quote: "Identity Protection is a tool that allows organizations to... Automate the detection and remediation of identity-based risks. Investigate risks using data in the portal... Identity Protection detects risks of many types, including anonymous IP address use, atypical travel, malware linked IP address, unfamiliar sign-in properties, leaked credentials, password spray, and more."

Source: Microsoft Learn, https://learn.microsoft.com/en-us/entra/id-protection/overview-identity-protection.

Microsoft Defender for Cloud Apps documentation | Anomaly detection policies

Quote: "Mass download by a single user: This detection identifies users who download an unusually high number of files compared to their baseline. This policy can be used to detect a user that may be compromised and is exfiltrating corporate data from a sanctioned app such as SharePoint, OneDrive, Box or others."

Source: Microsoft Learn, https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy.

Microsoft Defender for Cloud Apps documentation | How Defender for Cloud Apps helps protect your SharePoint Online environment

Quote: "As a featured app, Defender for Cloud Apps protects your files in SharePoint Online with out-of-the-box policies, such as... Detects when a user downloads a large number of files from SharePoint in a single session, which could indicate a breach attempt (Mass download)."

Source: Microsoft Learn, https://learn.microsoft.com/en-us/defender-cloud-apps/protect-sharepoint.