ISVs use this capability to allow their code to run with minimal need for configuration in tenants that install ISV solutions. If an app is designed to work across all tenants, the same set of permissions applies to each tenant. A malicious app added to the tenant has an Azure AD identity (the application object) and a service principal, used to hold the set of permissions assigned to the app. Of course, we need to write a script to do the work, but the task isn’t that difficult. I’ve covered the topic of using Azure Automation in several articles recently, and it seems like this would be a good scenario to explore with managed identities and the Microsoft Graph PowerShell SDK. The problem is that we all have too much work to do, which is why a scheduled PowerShell script executed regularly by Azure Automation can help. The important thing is to review apps regularly. You can use Microsoft Defender for Cloud Apps to review apps and permissions, or you can create your own tool for this purpose. Ideally, an audit of apps and permissions should happen monthly with the intention of removing apps that are no longer required or removing permissions that apps no longer need. The bad app can be registered in your tenant or enabled for use in any Azure AD tenant.īecause threats like this exist, it’s important that Microsoft 365 tenants check the set of active apps in the tenant and the permissions assigned to each app. The article discusses how phishing emails containing a link requiring the recipient to grant access to a malicious application through the OAuth authorization flow ends up with the malicious app gaining permissions to gather information from the tenant (what Microsoft refers to as illicit consent grants). I recently read an article by Lina Lau discussing How to detect Token Theft in Azure, explaining how attackers use apps to steal access tokens to compromise Azure AD user accounts.

The Administrative Challenge of Azure AD Appsĭetecting Malicious Apps that Steal Graph Permissions.Sending the Azure AD Apps Report to Teams.

Finding the Important Permissions Held by Azure AD Apps.

Detecting Malicious Apps that Steal Graph Permissions.

Permissions reporter