Suspicious OAuth Application Consent Grant in Microsoft 365
Illicit OAuth consent grants are a persistent M365 attack vector where users are tricked into granting third-party applications excessive permissions to their Microsoft 365 data. Attackers register OAuth apps with convincing names ('HR Document Portal', 'Microsoft Security Update', 'Teams Bot') and send phishing emails directing users to 'consent' to the app. Once consented, the attacker's app has persistent API access (often with Mail.Read, Contacts.Read, Files.Read, or offline_access) without needing the user's credentials or bypassing MFA. Microsoft documented Storm-0558 and Midnight Blizzard using this technique. NCSC UK warns that illicit consent grants are particularly effective against SMBs because many lack admin consent workflows. Attackers can also use 'consent phishing' through OAuth apps registered in the same Entra ID tenant after initial compromise.
What is THREAT-M365-SuspiciousOAuthConsent Suspicious OAuth Application Consent Grant in Microsoft 365?
Suspicious OAuth Application Consent Grant in Microsoft 365 (THREAT-M365-SuspiciousOAuthConsent) maps to the Credential Access and Collection tactics — the adversary is trying to steal account names and passwords in MITRE ATT&CK.
This page provides production-ready detection logic for Suspicious OAuth Application Consent Grant in Microsoft 365, covering the data sources and telemetry it touches: Azure AD Audit Logs (AuditLogs), Office 365 Unified Audit Log (OfficeActivity), Microsoft 365 Defender. The queries below are rated high severity at high confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.
MITRE ATT&CK
- Tactic
- Credential Access Collection
// THREAT: Suspicious OAuth Application Consent Grant
// Detects illicit OAuth consent grants in Microsoft 365 / Entra ID
// Primary telemetry: Azure AD Audit Logs, O365 audit logs
// Alert 1: High-privilege OAuth application consent grants
let SensitivePermissions = dynamic([
"Mail.Read", "Mail.ReadWrite", "Mail.Send",
"Mail.ReadBasic.All", "MailboxSettings.ReadWrite",
"Files.Read.All", "Files.ReadWrite.All",
"Contacts.Read", "Contacts.ReadWrite",
"User.Read.All", "User.ReadWrite.All",
"Group.Read.All", "Directory.Read.All",
"offline_access", "Calendars.ReadWrite",
"Sites.Read.All", "Sites.ReadWrite.All"
]);
AuditLogs
| where TimeGenerated > ago(24h)
| where OperationName has_any ("Consent to application", "Add app role assignment to service principal",
"Add delegated permission grant", "Add OAuth2PermissionGrant")
| where Result =~ "success"
| extend AppName = tostring(TargetResources[0].displayName)
| extend GrantedPermissions = tostring(AdditionalDetails)
| extend ConsentorIP = tostring(InitiatedBy.user.ipAddress)
| extend ConsentorUPN = tostring(InitiatedBy.user.userPrincipalName)
| where GrantedPermissions has_any (SensitivePermissions)
or OperationName has "admin consent"
| project TimeGenerated, OperationName, AppName, ConsentorUPN,
ConsentorIP, GrantedPermissions, TargetResources
| extend ThreatType = "OAuthConsent_SensitivePermissions";
// Alert 2: First-time application consent (new app never seen before in tenant)
let KnownApps = AuditLogs
| where TimeGenerated between (ago(90d) .. ago(1d))
| where OperationName has "Consent to application"
| extend AppId = tostring(TargetResources[0].id)
| distinct AppId;
AuditLogs
| where TimeGenerated > ago(24h)
| where OperationName has "Consent to application"
| extend AppId = tostring(TargetResources[0].id)
| extend AppName = tostring(TargetResources[0].displayName)
| where AppId !in~ (KnownApps)
| project TimeGenerated, AppName, AppId, InitiatedBy, TargetResources
| extend ThreatType = "OAuthConsent_NewUnseenApplication"Dual OAuth consent detection: (1) consent grants that include sensitive permissions (Mail.Read, Files.Read.All, offline_access) — these are the permissions attackers seek to maintain persistent email and file access; (2) consents to applications not seen in the tenant in the past 90 days — first-time app consents from non-admin users are a common illicit consent grant pattern. Both should trigger review against Microsoft AppSource or your internal app registry.
Data Sources
Required Tables
False Positives
- IT administrators deploying approved third-party Microsoft 365 integrations (Slack, Zoom, Adobe, DocuSign) and granting required permissions
- Users adding approved productivity apps from Microsoft AppSource that request standard permissions
- Microsoft-published applications (Power Automate, Power BI) requesting permissions during initial setup
- Internal developers registering apps for legitimate automation workflows
Sigma rule & cross-platform mapping
The detection logic for Suspicious OAuth Application Consent Grant in Microsoft 365 (THREAT-M365-SuspiciousOAuthConsent) above is provided in a vendor-neutral
form so you can deploy it on any SIEM. The same logic is shipped here as native
KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the
following logsource:
logsource:
product: azureBrowse the community-maintained Sigma rules for this technique:
Platform-specific guides for THREAT-M365-SuspiciousOAuthConsent
Testing Methodology
Validate this detection against 1 adversary technique from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Illicit OAuth Consent Grant Simulation
Expected signal: Azure AD Audit log records 'Consent to application' event with Mail.Read, offline_access, and Files.Read.All permissions for the test user.
Unlock Pro Content
Get the full detection package for THREAT-M365-SuspiciousOAuthConsent including response playbook, investigation guide, and atomic red team tests.