Microsoft explains that probing OneDrive and SharePoint URLs can reveal user principal names without appearing in Entra sign-in logs or Microsoft Purview, and no direct alert currently covers that reconnaissance. It is classified as low risk because it does not bypass authentication, but discovered names can support targeted phishing and credential attacks. Excessive requests to nonexistent sites may be throttled, which is not a guarantee of complete detection. Organizations should use multifactor authentication, Conditional Access and phishing defenses rather than treat an absence of logs as proof that no probing or breach occurred.