Attackers expand Microsoft 365 OAuth consent abuse, granting persistent Graph access without MFA

On Wednesday, enterprise defenders tracked active consent phishing against Microsoft 365 tenants that abuses multi tenant Azure applications to persist through password resets and bypass strong authentication. The operators seek long lived refresh tokens and Microsoft Graph scopes to read mail and files, then exfiltrate over legitimate cloud endpoints.

The technique matters because multifactor prompts do not block it once a user approves the app. Refresh tokens with offline access renew silently, and the activity often blends into normal cloud API traffic.

How the intrusion works

Phishing lures drive targets to the Microsoft authorize endpoint with tenant set to common and parameters such as prompt set to consent or admin consent. If a user with sufficient role rights accepts scopes like Mail.Read, Files.ReadWrite.All, Sites.Read.All, and offline_access, Entra ID creates a service principal in the tenant and issues an authorization code and refresh token.

Attackers exchange the code for tokens and pivot to API only operations. They query Graph to enumerate users and mailboxes, pull messages with delta queries, create hidden inbox rules, and register subscriptions for change notifications to attacker controlled webhooks.

Persistence follows from the grant that lives on the service principal, so access survives password changes and stronger MFA challenges. Adversaries add app roles, configure additional secrets or certificates, and seek reconsent to expand scope when they later compromise an administrator.

Criminal groups running business email compromise rely on this model, and APT29, also tracked as Midnight Blizzard, has used consent grants in prior espionage operations. Incident responders also tie current cases to operators who previously used adversary in the middle kits, now pivoting to app based persistence to reduce endpoint noise.

Mitigation and detection

Security teams should disable user consent by default and require the admin consent workflow with publisher verification. Restrict app use to verified publishers and pre approve only the minimum scopes that business workflows need.

Create Conditional Access policies that target user actions for register applications and require MFA or block that action for non administrative roles. Apply app governance in Defender for Cloud Apps to monitor OAuth apps and alert on unusual Graph activity volumes or risky permissions.

Hunt in Entra ID audit logs for Add service principal, Consent to application, and Update application events, and in sign in logs for non interactive service principal activity. Review Enterprise Applications for newly created multi tenant apps, revoke grants by removing service principals and oauth2PermissionGrants, rotate secrets and certificates, and validate that no inbound webhooks point to untrusted domains.

The shift from endpoint malware to identity and API abuse puts the cloud control plane at the center of incident response. Effective defense now depends on strict consent policies, least privilege on OAuth scopes, and routine hunting in identity telemetry, since attackers can operate entirely inside sanctioned services.