Microsoft Graph API Unauthorized Consent and OAuth Consent Abuse Response
Response steps covering consent revocation, application shutdown, and tenant hardening for access-persistence attacks carried out via OAuth consent hijacking, credential addition, and Graph API permission escalation chains through a rogue Entra ID application or service principal.
Mail.ReadWrite or Directory.ReadWrite.All scope on the Microsoft Graph API are particularly risky. To prevent recurrence, disable user-level application consent and allow only admin-approved applications; this policy can be enforced with Conditional Access.Prepare
6 steps- AuditLogs and SigninLogs Sentinel stream active
Entra ID `AuditLogs`, `SigninLogs`, `AADServicePrincipalSignInLogs`, and preferably `MicrosoftGraphActivityLogs` must be routed to Sentinel and retained for at least 90 days; without these sources, consent and SP credential events are invisible.
- Detection rules live
`Consent to application` high-risk permission alarm, `Update Application/Service Principal` with `PasswordCredentials`/`KeyCredentials` change alarm, and `Add app role assignment to service principal` critical permission alarm must be tuned in production; Microsoft Sentinel templates: `NewAppOrServicePrincipalCredential.yaml`, `ServicePrincipalAssignedAppRoleWithSensitiveAccess.yaml`, `MailPermissionsAddedToApplication.yaml`.
- Application inventory current
All application registrations, service principals, owners, and permission profiles in the tenant must be documented; orphan (unknown-owner) SPs must be reviewed periodically.
- Honey-app canary deployed
A high-privilege decoy application that appears attractive but is never used; any credential addition, consent, or token request to this application triggers a critical alarm.
- IR authority defined
An Entra Global Admin or delegate with approval authority for application disabling and consent revocation must be reachable 24/7; pre-approvals for App Governance / Defender for Cloud Apps policy automation must be established.