The problem is that we all have too much work to do, which is why a scheduled PowerShell script executed regularly by Azure Automation can help. The important thing is to review apps regularly. You can use Microsoft Defender for Cloud Apps to review apps and permissions, or you can create your own tool for this purpose. Ideally, an audit of apps and permissions should happen monthly with the intention of removing apps that are no longer required or removing permissions that apps no longer need. The bad app can be registered in your tenant or enabled for use in any Azure AD tenant.īecause threats like this exist, it’s important that Microsoft 365 tenants check the set of active apps in the tenant and the permissions assigned to each app. The article discusses how phishing emails containing a link requiring the recipient to grant access to a malicious application through the OAuth authorization flow ends up with the malicious app gaining permissions to gather information from the tenant (what Microsoft refers to as illicit consent grants).

I recently read an article by Lina Lau discussing How to detect Token Theft in Azure, explaining how attackers use apps to steal access tokens to compromise Azure AD user accounts.

The Administrative Challenge of Azure AD Appsĭetecting Malicious Apps that Steal Graph Permissions.

Sending the Azure AD Apps Report to Teams.

Finding the Important Permissions Held by Azure AD Apps.

Detecting Malicious Apps that Steal Graph Permissions.

Active directory permissions report