Build1 publisher2 min readPublished
An external app with user consent reads mail without holding an account in the tenant
Microsoft's guidance on illicit consent grants says password resets and MFA do not touch the access, and it sends admins to the Purview audit log, where the entry can take up to 24 hours to appear.
The Engineer · Build desk
What happened
- In Microsoft's account of an illicit consent grant, the attacker registers an app in Entra ID that asks for contact information, email or documents, then phishes users or injects code into a trusted site to collect consent.
- Once a user grants consent, the application has account-level access to that data without needing an account in the organization at all.
- The documented detection route is a search of the Microsoft Purview audit log, Standard or Premium, for Consent to application activities, which Microsoft treats as indicators of compromise.
- Inside a matching audit entry, an IsAdminConsent value of True indicates that someone with Global Administrator access might have granted broad access to data.
Compiled by The EngineerSomething wrong?How this is made
Why it matters
- constraint Hardening authentication policy leaves this path open, so the work sits with whoever owns app inventory and consent review.
- cost Confirming a suspected grant through the Entra admin center scales with headcount at one user per check, so a large tenant is either paying for PowerShell competence or waiting.
- exposure Since searchable audit history follows each user's licence, the accounts whose records lapse first are the ones an investigation will not be able to clear.
- capability Defender for Cloud Apps OAuth app policies let an admin widely ban a permissions request, so remediation does not have to be chased user by user.
Microsoft's page states the response problem: "Normal remediation steps (for example, resetting passwords or requiring multifactor authentication (MFA)) aren't effective against this type of attack, because these apps are external to the organization" [4]. The same page describes the attack as one that "presumes the entity calling the information is an automation, not a human" [16].
Detection timing sets the exposure window. An audit entry can take from 30 minutes up to 24 hours to appear in search results after the event, according to the documentation [9]. For tenants with many registered apps and a large user base, the same page recommends reviewing consent grants weekly [14]. Seven days of review interval plus a day of ingestion delay puts about eight days between a grant and the first scheduled search that could see it [1]. Anything faster needs an alert on the consent event.
Three paths are documented. Inventory apps and permissions in the Microsoft Entra admin center, which is thorough but checks one user at a time and is described as very time consuming with many users [10]. Inventory with PowerShell, which the page calls the fastest method with the least overhead [11]. Or have users individually check their own apps and permissions and report the results back to admins for remediation [15]. That third path depends on users remembering what they consented to.
The recurring work is small. It needs the Audit page in the Microsoft Defender portal [6] and a search sorted on the Activity column for Consent to application entries [7]. It also needs a standing rule for what to do when IsAdminConsent comes back True.
The window in which a grant can still be proved varies by user. How long an audit record is retained and searchable depends on the Microsoft 365 subscription, and specifically on the licenses assigned to specific users [13].
What to watch
- Any change to the 30-minutes-to-24-hours audit ingestion delay moves the eight-day worst case directly.
- Whether Microsoft keeps recommending a weekly consent review as tenants accumulate more registered apps.
- If audit retention stops depending on per-user licences, the investigation window stops varying inside one tenant.