Search for a command to run...
This post outlines how to prevent users in your organisation from accepting dangerous OAuth prompts like the one shown below — where a third-party app
No comments yet. Be the first to comment.
Designing a Resilient Linux Application Stack on Windows Infrastructure.
A deep dive on ClickFix, mapping fake CAPTCHA lures to endpoint code execution, covering investigation, response, and preventative controls.
Overview. Prerequisites. Join types. LAPS is only supported on: Microsoft Entra joined devices. Microsoft Entra hybrid joined devices. Microsoft Entra registered devices are not supported. License requirements. LAPS is available to all customers ...
A complete analysis of a compromised identity in Microsoft 365, covering key tactics, techniques, and procedures.
Streamlining Level RMM deployment across Windows devices using PowerShell and a Microsoft Intune deployment script.
Ciaran Doherty's SecOps Blog
24 posts
Modern SaaS platforms frequently ask users to grant access to their Microsoft 365 data via OAuth permissions. While this is intended to improve integrations and productivity, it also presents a significant security risk — especially when users unknowingly grant access to unverified or overly permissive third-party applications.
This post outlines how to prevent users in your organisation from accepting dangerous OAuth prompts like the one shown below — where a third-party app requests full access to mail, calendars, and user profiles.
Attackers — or poorly vetted apps — can abuse the Microsoft identity platform to request OAuth permissions under the guise of being helpful tools. If granted, these apps can:
Read/send emails on the user’s behalf
Harvest calendars, personal information, or attachments
Maintain long-term access even after the user signs out
For example, the app “HubSpot Sales” requests:
Full read/write access to mail.
Calendar access.
Profile and sign-in permissions.
This is not a mild integration — it’s full impersonation. And if the app isn't reviewed properly by IT, the impact could be severe.
Microsoft Entra ID (formerly Azure AD) allows fine-grained control over user consent. Here’s how to lock this down:
Access the Microsoft Entra ID portal.
Navigate to:
Select either:
Allow user consent for apps from verified publishers, for selected permissions (Recommended).
Do not allow user consent.
Allow users to request admin approval when they encounter apps that require consent.
Navigate to:
Select Yes to enable the feature.
Specify users, groups, or roles who can review admin consent requests.
OAuth abuse remains one of the more subtle but dangerous security threats in cloud environments. The good news is that Microsoft Entra provides the controls you need, but only if you configure them correctly.
By disabling broad user consent and requiring admin approval, you safeguard organisational data from silent exfiltration and abuse.
Refer to Microsoft Learn - Configure how users consent to applications for more information.
Need help hardening your Microsoft 365 tenant? Feel free to reach out or check my other blogs at blog.cdoherty.co.uk