Hello Schulz, James,
Thank you for reaching out to Microsoft!
For the query mentioned on how to identify source from ID field,
Go to the Microsoft Entra admin center and navigate to Identity>Overview>Recommendations.
Locate the Recommendation - Find the recommendation related to Azure AD Graph API usage.
Click on the recommendation to view more details. This will provide you with information about the applications or service principals using the Azure AD Graph API.
Look for the ID number associated with the high incident. This ID will help you identify the specific application or service principal causing the issue.
Azure Active Directory (Azure AD) Graph is deprecated and is currently in its retirement path. It is recommended that you migrate your apps to Microsoft Graph if you have AD Graphs.
If you are finding "Microsoft Office" application (ID of d3590ed6-52b3-4102-aeff-aad2292ab01c), you can safely ignore that.
For the rest, please read our recently updated Blog Post in this regard:
Also, to continue to use Azure AD Graph Apps until they are switched over to Microsoft Graph
Manage application authenticationBehaviors - Microsoft Graph | Microsoft Learn
Additionally, here is a reference for all Microsoft First Party Application IDs for your reference:
References:
2.https://github.com/merill/microsoft-info/blob/main/_info/MicrosoftApps.csv
Hope this helps.
If the answer is helpful, please click Accept Answer and kindly upvote it. If you have any further questions about this answer, please click Comment.