graph-relay.cozy-bear.attackoftheapts.com
Fenwick Systems' logged Graph API egress relay. All Microsoft Graph
traffic for this tenant is routed through here, matching the exact
host captured in the anomalous session's network trace.

Endpoints:
  GET /v1.0/users
  GET /v1.0/users/{id}/messages

Both require: Authorization: Bearer <token from the captured session>