Security1 publisher2 min readPublished
Consent phishing shows up in a victim's tenant only as service principal and grant events
Consent phishing, the most common OAuth entry point according to SC World, leaves a victim tenant three audit events and no app registration record. Registration monitoring misses it, so the hunt moves to consent and delegated-grant operations in the defender's own logs.
The Watch · Security desk
What happened
- A user who clicks Allow on the attacker's OAuth link creates a service principal in their own tenant and grants the app delegated permissions to act for them.
- SC World names Mail.Read, Mail.Send, MailboxSettings.ReadWrite, Files.ReadWrite.All and offline_access as the realistic high-risk delegated scopes.
- Org-wide mailbox access takes application permissions granted as an app role assignment, and those always need admin consent.
- SC World ties credential additions to existing apps, its larger persistence risk, to the SolarWinds compromise and the Midnight Blizzard attacks on Microsoft.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure Each phished user hands over their own mail and files, and an offline_access grant turns that into long-lived access, so exposure grows with every user who clicks.
- decision Tightening admin consent settings closes the consent path only; device code phishing and preconsented-app abuse need controls of their own.
- constraint Once an attacker moves to credentials on an existing app, resetting the phished user's password does not end the access.
The three events are Add service principal, Consent to application and Add delegated permission grant [5]. SC World's detection guidance adds a fourth, Add app role assignment to service principal, and pairs it with a sample query that looks back seven days [15][17].
The SC World piece is a technique explainer [1]. It does not report a new campaign, a CVE or a date [1].
One user's consent reaches only as far as that user's own access. Consent to Mail.Read exposes the consenting user's mailbox, not the organization's [6]. Regular users cannot grant Directory.ReadWrite.All under any circumstances, according to SC World [8]. SC World says the consent prompt's design makes it difficult for users to evaluate what a combination of permissions enables. Its example is a calendar integration that requests Mail.Send [14].
Hunting the grants takes parsing. Permission values sit in TargetResources[*].modifiedProperties, not in a flat searchable string, and the acting identity comes from InitiatedBy [16]. The sample consent query covers 24 hours of Consent to application events and filters those properties for the high-risk scopes [17]. SC World calls its queries logic patterns and tells readers to validate field paths against their own tenant's log schema before deploying [16].
Two of the vectors SC World describes sit outside admin consent policy [19]. In device code phishing the user authenticates against a legitimate Microsoft endpoint, so standard phishing controls offer limited protection [12]. Certain first-party Microsoft apps hold broad permissions by default from tenant provisioning. An attacker with a compromised user account can use those grants without triggering any new consent event [13].
The persistence step comes later. After a foothold through a compromised admin account or an exploited app, attackers attach certificates or client secrets to legitimate applications or service principals, or assign privileged app roles to an app they control [10]. The resulting access is application-level and persists independently of any user account, according to SC World [11].
What to watch
- A Microsoft change to the broad default permissions first-party apps receive at tenant provisioning, the path that writes no new consent event.
- A published detection pattern for device code phishing; the sample queries in the SC World piece target consent and app role assignment events.
- A reported campaign that chains consent phishing into credential additions on existing apps, the step SC World ties to SolarWinds and Midnight Blizzard.