APT29 expands OAuth consent abuse across Microsoft 365 tenants, defenders urged to lock down app grants

APT29, tracked by Microsoft as Midnight Blizzard, is actively abusing OAuth consent flows in Microsoft 365 to gain long lived access to corporate email and files, security teams said Wednesday. The cluster registers lookalike multi tenant apps, harvests user approval through device code prompts, then uses Microsoft Graph with offline access to pull data at scale from Entra ID tenants.

The technique matters because it bypasses passwords and most MFA prompts. Consent grants live at the application layer, so resetting credentials or rotating tokens does not remove access until the malicious service principal and its grants are revoked.

Tactics and mitigations

Incident responders report the threat actor requests scopes such as Mail.Read, Mail.ReadWrite, Files.Read.All, Sites.Read.All, and offline_access. After consent, the actor adds additional credentials to the service principal or creates new apps to survive remediation. Activity often shows up as Graph API calls from cloud infrastructure rather than interactive logins, and it blends with legitimate automation.

Defenders should disable user consent by default, require admin approval for all apps, and restrict consent to verified publishers with low risk scopes. Review Entra ID audit logs for events such as Consent to application, Add service principal, Update application, and Service principal credentials added. Enumerate oauth2PermissionGrants and appRoleAssignments via Microsoft Graph, revoke suspicious grants, and delete untrusted service principals.

Monitor Sign in logs for device code flow events and anomalous IP ranges, and enable app governance to baseline OAuth app behavior. Apply Conditional Access to require compliant devices or trusted locations for access to Exchange Online and SharePoint Online. Where available, enable token protection and Continuous Access Evaluation for supported clients. In Exchange Online, block auto forwarding to external domains to reduce secondary exfil paths.

Attribution and context

Microsoft disclosed in January 2024 that Midnight Blizzard used malicious OAuth apps to exfiltrate email from Exchange Online, and follow on reporting from CISA and industry responders detailed consent phishing and device code abuse against cloud identities. The current activity is consistent with those tradecraft elements, and it continues to target organizations with permissive consent policies and limited visibility into third party app activity.

For the broader technology landscape, the campaign underscores that identity and app governance controls are the new perimeter for SaaS. Enterprises need continuous monitoring of service principals and workload identities, not only users, and procurement processes that vet publisher verification and requested scopes before any cloud app connects to core collaboration data.