Tenant telemetry is the security and audit data produced by a cloud tenant, meaning a single organization’s hosted environment in services such as Microsoft 365 or Azure. It includes identity events, sign-ins, API calls, app consent records, mailbox and calendar changes, and administrative actions. This data is the raw material defenders use to understand what users, applications, and services are doing inside the tenant.
It matters because modern attacks often stay inside legitimate cloud activity. A compromised account, abused service principal, or malicious app can generate traffic that looks normal unless telemetry is reviewed carefully. Analysts look for unusual calendar edits, unexpected Microsoft Graph access, new consent grants, suspicious token use, or changes that do not match a user’s usual behavior. Good tenant telemetry supports detection, investigation, and containment when attackers try to hide in everyday cloud workflows.