Microsoft 365 OAuth consent grant
A Microsoft Entra ID / Microsoft 365 OAuth application consent or permission grant ("Consent to application.", "Add OAuth2PermissionGrant.", "Add…
What it detects
A Microsoft Entra ID / Microsoft 365 OAuth application consent or permission grant ("Consent to application.", "Add OAuth2PermissionGrant.", "Add delegated permission grant."). Illicit-consent (consent-phishing) attacks trick a user or admin into granting a malicious app standing access to mail and files — access that persists without a password and bypasses MFA.
MITRE ATT&CK mapping
- T1528Steal Application Access Token· Credential Access
False positives and triage
Admins legitimately consent to new SaaS apps. Review the application, the publisher, and the delegated scopes granted (mail.read, files.readwrite, offline_access are high-value); an unknown app with broad mail/file scopes is the concern, especially if a non-admin user granted it.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 75%. Source: rules/cloud/m365_oauth_consent_grant.yaml, licensed under the Apache License 2.0.
id: cloud.identity.m365_oauth_consent_grant
version: 1.0.0
status: stable
severity: high
confidence: 0.75
platforms: [application]
mitre_techniques: [T1528]
description: |
A Microsoft Entra ID / Microsoft 365 OAuth application consent or permission
grant ("Consent to application.", "Add OAuth2PermissionGrant.", "Add delegated
permission grant."). Illicit-consent (consent-phishing) attacks trick a user or
admin into granting a malicious app standing access to mail and files — access
that persists without a password and bypasses MFA.
match:
provider: Office365
event_action_any:
- "Consent to application."
- "Add OAuth2PermissionGrant."
- "Add delegated permission grant."
- "Add app role assignment grant to user."
correlation_keys: [user_name]
false_positive_guidance: |
Admins legitimately consent to new SaaS apps. Review the application, the
publisher, and the delegated scopes granted (mail.read, files.readwrite,
offline_access are high-value); an unknown app with broad mail/file scopes is
the concern, especially if a non-admin user granted it.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.